CVE-2023-33107
Qualcomm Multiple Chipsets Integer Overflow Vulnerability
Description
CVE-2023-33107 is a high-severity memory corruption vulnerability in Qualcomm’s Graphics Linux subsystem, scoring 8.4 on the CVSS 3.1 scale. The flaw occurs during the assignment of a shared virtual memory region through an IOCTL call, where insufficient bounds checking or integer overflow conditions (CWE-190) lead to memory corruption. A local attacker without any privileges can trigger this vulnerability, potentially gaining full control over the affected system. The vulnerability affects a broad range of Qualcomm chipsets used in mobile, IoT, and connected devices, and has been confirmed by CISA as a known exploited vulnerability with a remediation deadline of December 26, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | 315 5g iot modem firmware | - |
| qualcomm | apq8017 firmware | - |
| qualcomm | apq8064au firmware | - |
| qualcomm | aqt1000 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | c-v2x 9150 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | csrb31024 firmware | - |
| qualcomm | fastconnect 6200 firmware | - |
| qualcomm | fastconnect 6700 firmware | - |
| qualcomm | fastconnect 6800 firmware | - |
| qualcomm | fastconnect 6900 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | flight rb5 5g platform firmware | - |
| qualcomm | mdm9250 firmware | - |
| qualcomm | mdm9650 firmware | - |
| qualcomm | msm8108 firmware | - |
| qualcomm | msm8209 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
This vulnerability is classified under CWE-190, which describes weaknesses where an integer arithmetic operation produces a result that overflows or wraps around beyond the maximum or minimum value representable by the data type. When this occurs in memory management code, the resulting incorrect value can be used to allocate undersized memory buffers or to corrupt adjacent memory regions.
In this specific case, the integer overflow occurs within the Graphics Linux kernel driver during an IOCTL call responsible for assigning shared virtual memory regions. The corrupted memory state can then be leveraged by an attacker to achieve arbitrary code execution or escalate privileges on the affected device.
Impact Analysis
CVE-2023-33107 carries a High severity rating with a CVSS score of 8.4. The attack vector is local (AV:L), requiring physical or authenticated access to the device, but no privileges are needed (PR:N) and no user interaction is required (UI:N).
Confidentiality Impact (High): Successful exploitation can expose kernel memory and sensitive data stored on the device, including credentials, encryption keys, and private communications.
Integrity Impact (High): Memory corruption can allow an attacker to overwrite critical kernel data structures, enabling arbitrary code execution and modification of system state.
Availability Impact (High): The memory corruption may result in kernel panics, system crashes, or a device that becomes completely unresponsive.
The broad scope of affected Qualcomm chipsets — spanning mobile devices, IoT modules, automotive platforms, and networking chips — significantly amplifies the real-world impact. CISA’s inclusion of this CVE in its KEV catalog confirms active exploitation.
Exploit Maturity
CVE-2023-33107 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild with a remediation deadline of December 26, 2023. The EPSS score is approximately 0.00246 (47.6th percentile), suggesting that while exploitation is confirmed, automated or widespread exploitation may be more targeted in nature. Given the local attack vector, exploitation typically requires an attacker who already has access to the device, such as through a malicious application or physical access, which is consistent with targeted mobile exploitation scenarios.
Remediation
- Apply Qualcomm security patches: Install the security updates provided in the Qualcomm December 2023 Security Bulletin for all affected chipsets.
- Follow KEV directive: Per CISA’s KEV guidance, apply vendor mitigations or discontinue use of the product if patches cannot be applied by the due date (2023-12-26).
- Update device firmware: Ensure that OEM-provided firmware and software updates are applied promptly, as chipset patches are delivered through device manufacturer updates.
- Control application installation: Restrict installation of untrusted applications on affected devices to reduce the risk of local exploitation.
- Monitor for anomalous kernel activity: Deploy endpoint detection tools capable of detecting kernel-level exploitation attempts or privilege escalation events.
- Assess device inventory: Identify all devices in your environment that use affected Qualcomm chipsets and prioritize patching based on exposure and criticality.
Technical Details
CVE-2023-33107 is rooted in CWE-190 (Integer Overflow or Wraparound) within Qualcomm’s Graphics Linux kernel driver. The vulnerability is triggered during an IOCTL call that assigns a shared virtual memory region between the kernel driver and a user-space process.
When a user-space application submits an IOCTL request to assign a shared virtual memory region, the kernel driver processes the request’s parameters — including memory sizes and offsets — using integer arithmetic. If the input values are crafted such that the arithmetic operation overflows the integer’s maximum representable value, the computed result wraps around to a much smaller number. This smaller value is then used as the size or index for a memory allocation or access, leading to memory corruption in the kernel address space.
The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that exploitation is straightforward once local access is obtained: no privileges are required, the attack complexity is low, and full system compromise (confidentiality, integrity, and availability all High) is achievable. The unchanged scope means the impact is contained within the kernel security context, but this still encompasses the full operating system.
Frequently Asked Questions
What devices are affected by CVE-2023-33107?
The vulnerability affects a wide range of Qualcomm chipsets found in smartphones, IoT modules, automotive platforms, and networking devices. This includes chipsets such as the Fastconnect series, QCA series, APQ series, and many others. Device manufacturers using these chipsets must release firmware updates incorporating Qualcomm’s patches.
Can this vulnerability be exploited remotely?
No. CVE-2023-33107 has a local attack vector, meaning an attacker must have some form of local access to the device — for example through a malicious application, physical access, or exploitation of a separate vulnerability. Remote exploitation is not directly possible without a local foothold.
Why is CVE-2023-33107 in the CISA KEV catalog despite a relatively low EPSS score?
CISA’s KEV catalog reflects confirmed in-the-wild exploitation, not just theoretical risk. Even with a moderate EPSS percentile, targeted exploitation by sophisticated threat actors — particularly in mobile spyware or nation-state attack campaigns targeting specific individuals or organizations — can lead to KEV inclusion.
How do organizations patch this vulnerability on end-user devices?
Patches for Qualcomm chipset vulnerabilities are distributed through device manufacturers (OEMs) rather than directly from Qualcomm. Organizations should ensure all affected devices are updated to the latest firmware from their device vendor, which should incorporate Qualcomm’s December 2023 security patches.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.