CVE-2024-43047
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Description
CVE-2024-43047 is a high-severity memory corruption vulnerability affecting multiple Qualcomm chipsets, triggered while maintaining memory maps of High Level Operating System (HLOS) memory. A local attacker with low-level privileges can exploit this flaw to corrupt memory in the chipset's Digital Signal Processor (DSP) subsystem, potentially achieving arbitrary code execution at the firmware level. With a CVSS v3.1 base score of 7.8 and full impact across confidentiality, integrity, and availability, the vulnerability affects a wide range of Qualcomm products including FastConnect 6700/6800/6900/7800, QCA6174A, QCA6391, QCS410/610/6490, and several other chipset firmware packages. CISA has added CVE-2024-43047 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 29, 2024, and its EPSS score of 1.75% at the 82.3rd percentile confirms targeted exploitation in real-world attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | fastconnect 6700 firmware | - |
| qualcomm | fastconnect 6800 firmware | - |
| qualcomm | fastconnect 6900 firmware | - |
| qualcomm | fastconnect 7800 firmware | - |
| qualcomm | qam8295p firmware | - |
| qualcomm | qca6174a firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qca6426 firmware | - |
| qualcomm | qca6436 firmware | - |
| qualcomm | qca6574au firmware | - |
| qualcomm | qca6584au firmware | - |
| qualcomm | qca6595 firmware | - |
| qualcomm | qca6595au firmware | - |
| qualcomm | qca6688aq firmware | - |
| qualcomm | qca6696 firmware | - |
| qualcomm | qca6698aq firmware | - |
| qualcomm | qcs410 firmware | - |
| qualcomm | qcs610 firmware | - |
| qualcomm | qcs6490 firmware | - |
| qualcomm | video collaboration vc1 platform firmware | - |
References
- https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43047(US Government Resource)
Weakness Type
Memory Corruption in HLOS Memory Map Management
CVE-2024-43047 is a memory corruption vulnerability in Qualcomm chipset firmware that occurs during the management of memory maps between the High Level Operating System (HLOS, typically Android or Linux) and the DSP (Digital Signal Processor) subsystem. Memory mapping operations are critical for allowing the host operating system to share memory regions with hardware accelerators and signal processors. The vulnerability arises when the chipset firmware fails to properly validate or manage these shared memory map operations, allowing a locally privileged attacker to corrupt memory structures. This corruption can overwrite critical data or control flow information in the DSP firmware, ultimately enabling arbitrary code execution at the hardware subsystem level, which operates below the protections of the host operating system.
Impact Analysis
Confidentiality is fully compromised when CVE-2024-43047 is exploited, as code execution at the DSP firmware level grants the attacker access to all data processed by the chipset, including Wi-Fi credentials, Bluetooth pairing information, audio streams, and sensor data. The DSP operates below the operating system's security boundaries, meaning exploitation can bypass Android or Linux security controls entirely. This is particularly concerning for FastConnect chipsets which handle Wi-Fi and Bluetooth communications.
Integrity faces maximum impact because firmware-level code execution allows the attacker to modify any data processed by the affected chipset subsystems, inject malicious behavior into wireless communications, tamper with sensor data, or install persistent implants that survive operating system reinstallation. Firmware-level compromise is exceptionally difficult to detect using standard endpoint security tools.
Availability is also fully impacted, as the attacker can crash the DSP subsystem, disable wireless connectivity, or cause device instability. The local attack vector (AV:L) with low privileges required (PR:L) indicates this is a privilege escalation vulnerability that would typically be chained with other exploits in a multi-stage attack. The EPSS score of 1.75% at the 82.3rd percentile suggests targeted rather than mass exploitation, consistent with the sophistication required for chipset-level attacks. While ransomware association is listed as unknown, Qualcomm chipset vulnerabilities have been exploited by advanced threat actors including commercial spyware vendors for targeted surveillance operations.
Exploit Maturity
CVE-2024-43047 has confirmed active exploitation in the wild, evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of October 29, 2024. The EPSS score of 1.75% at the 82.3rd percentile reflects targeted exploitation rather than mass campaigns, which is typical for hardware-level vulnerabilities that require specialized knowledge to exploit.
Qualcomm has published a security advisory in their October 2024 Security Bulletin providing firmware patches for affected chipsets. This vulnerability was reported to Qualcomm by Google's Threat Analysis Group and Amnesty International's Security Lab, strongly suggesting it was discovered in the context of targeted surveillance operations, likely exploited by commercial spyware vendors. The combination of memory corruption at the chipset firmware level and the involvement of organizations tracking state-sponsored surveillance makes this vulnerability particularly notable. While no public proof-of-concept exploit has been released, the confirmed in-the-wild exploitation demonstrates that sophisticated threat actors possess working exploits. The broad range of affected chipsets, spanning mobile, IoT, and automotive platforms, expands the potential attack surface significantly.
Remediation
-
Apply Qualcomm firmware updates immediately. Install the patches provided in Qualcomm's October 2024 Security Bulletin. For mobile devices, this typically means installing the latest Android security patch level from your device manufacturer. For embedded and IoT devices using affected Qualcomm chipsets, contact your vendor for firmware update availability.
-
Verify device manufacturer patch availability. Since Qualcomm provides patches to OEMs who then distribute them to end users, check your specific device manufacturer's security bulletin to confirm the patch for CVE-2024-43047 is included. For Android devices, ensure the security patch level is October 2024 or later.
-
Restrict physical and local access to affected devices. The vulnerability requires local access (AV:L) with low privileges (PR:L). Limit who can install applications or access the device, particularly for enterprise-managed devices. Implement mobile device management (MDM) policies that restrict sideloading and enforce application whitelisting.
-
Deploy mobile threat detection solutions. Install mobile threat defense solutions that can detect indicators of chipset-level exploitation, unusual DSP behavior, or known commercial spyware signatures. Monitor for applications that request unusual hardware access permissions or exhibit behavior consistent with privilege escalation attempts.
-
Conduct a risk assessment for IoT and automotive deployments. If your organization uses devices with affected Qualcomm chipsets (FastConnect, QCA, QCS series) in IoT or automotive applications, evaluate the exposure risk and prioritize firmware updates. Isolate devices that cannot be immediately patched on network segments with restricted access.
Technical Details
CVE-2024-43047 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 7.8 (High). The local attack vector (AV:L) indicates the attacker must have local access to the device, while low attack complexity (AC:L) means no special conditions are required beyond local access. Low privileges are required (PR:L), making this a privilege escalation vulnerability, and no user interaction (UI:N) is needed.
The vulnerability exists in the memory management subsystem of Qualcomm's DSP (Digital Signal Processor) firmware, specifically in the code responsible for maintaining memory maps between the HLOS (High Level Operating System) and the DSP. Qualcomm chipsets use a shared memory architecture where the host OS and the DSP subsystem exchange data through mapped memory regions. The HLOS communicates with the DSP through a FastRPC (Remote Procedure Call) interface, passing memory descriptors that define shared buffers. The vulnerability occurs when the firmware improperly handles these memory map operations, failing to validate boundaries or reference counts, which leads to memory corruption in the DSP's address space.
The scope is unchanged (S:U), meaning the vulnerability directly impacts the DSP subsystem. However, because the DSP operates at a firmware level below the host OS security model, practical impact extends beyond what the scope metric suggests. Compromising the DSP can provide access to raw hardware interfaces, wireless communication channels, and sensor data streams that are normally isolated from user-space applications. The affected chipset families include FastConnect (Wi-Fi/Bluetooth), QCA (wireless networking), QCS (IoT/connected computing), and QAM (automotive) product lines, indicating the vulnerable memory management code is shared across Qualcomm's entire product portfolio.
Frequently Asked Questions
What is CVE-2024-43047?
CVE-2024-43047 is a memory corruption vulnerability in multiple Qualcomm chipset firmware packages that occurs during the management of shared memory maps between the device's operating system and its DSP (Digital Signal Processor). Successful exploitation allows an attacker with local access to achieve code execution at the firmware level with a CVSS score of 7.8.
Which devices are affected by CVE-2024-43047?
The vulnerability affects a broad range of Qualcomm chipsets including FastConnect 6700, 6800, 6900, and 7800 (used in smartphones and laptops for Wi-Fi/Bluetooth), QCA6174A and QCA6391 (wireless networking), QCS410/610/6490 (IoT platforms), and QAM8295P (automotive). Any device using these chipsets with unpatched firmware is potentially vulnerable.
How was this vulnerability discovered?
CVE-2024-43047 was reported by Google's Threat Analysis Group and Amnesty International's Security Lab, indicating it was discovered during investigations into targeted surveillance operations. This strongly suggests the vulnerability was being exploited by commercial spyware vendors to compromise specific individuals' devices.
How do I patch Qualcomm chipset firmware?
For smartphones and tablets, firmware updates are delivered through your device manufacturer's Android security updates. Install the latest available security patch (October 2024 or later). For embedded, IoT, or automotive devices, contact your hardware vendor for specific firmware update instructions, as these devices may require manual firmware flashing.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.