CVEs / CVE-2023-33107
CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability
- Known exploited in the CISA KEV catalog since 5 Dec 2023
- high 7.8 CVSS 3.1 (NVD)
- EPSS 0.73% chance of exploitation in the next 30 days, higher than 54% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-33107
Summary
Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Description
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Qualcomm, Inc. Snapdragon | 315 5G IoT Modem | — |
| Qualcomm, Inc. Snapdragon | APQ8017 | — |
| Qualcomm, Inc. Snapdragon | APQ8064AU | — |
| Qualcomm, Inc. Snapdragon | AQT1000 | — |
| Qualcomm, Inc. Snapdragon | AR8031 | — |
| Qualcomm, Inc. Snapdragon | AR8035 | — |
| Qualcomm, Inc. Snapdragon | C-V2X 9150 | — |
| Qualcomm, Inc. Snapdragon | CSRA6620 | — |
| Qualcomm, Inc. Snapdragon | CSRA6640 | — |
| Qualcomm, Inc. Snapdragon | CSRB31024 | — |
| Qualcomm, Inc. Snapdragon | FastConnect 6200 | — |
| Qualcomm, Inc. Snapdragon | FastConnect 6700 | — |
| Qualcomm, Inc. Snapdragon | FastConnect 6800 | — |
| Qualcomm, Inc. Snapdragon | FastConnect 6900 | — |
| Qualcomm, Inc. Snapdragon | FastConnect 7800 | — |
| Qualcomm, Inc. Snapdragon | Flight RB5 5G Platform | — |
| Qualcomm, Inc. Snapdragon | MDM9250 | — |
| Qualcomm, Inc. Snapdragon | MDM9650 | — |
| Qualcomm, Inc. Snapdragon | MSM8108 | — |
| Qualcomm, Inc. Snapdragon | MSM8209 | — |
| Qualcomm, Inc. Snapdragon | MSM8608 | — |
| Qualcomm, Inc. Snapdragon | MSM8909W | — |
| Qualcomm, Inc. Snapdragon | MSM8996AU | — |
| Qualcomm, Inc. Snapdragon | QAM8255P | — |
| Qualcomm, Inc. Snapdragon | QAM8295P | — |
| Qualcomm, Inc. Snapdragon | QAM8650P | — |
| Qualcomm, Inc. Snapdragon | QAM8775P | — |
| Qualcomm, Inc. Snapdragon | QCA6174A | — |
| Qualcomm, Inc. Snapdragon | QCA6310 | — |
| Qualcomm, Inc. Snapdragon | QCA6320 | — |
Exploitation
| In CISA KEV since | 5 Dec 2023 |
|---|---|
| Due date for US federal agencies | 26 Dec 2023 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. |
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-190 |
References
- CVE-2023-33107 on NVD
- CVE-2023-33107 in the CISA KEV catalog
- https://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/d66b799c804083ea5226cfffac6d6c4e7ad4968b (cited by CISA)
- https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33107 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.