CVE-2024-23377

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-823

Affected software

VendorProductVersions
Qualcomm, Inc.SnapdragonFastConnect 6900; FastConnect 7800; QCA6391; QCM8550; QCS7230; QCS8250; QCS8550; Qualcomm Video Collaboration VC5 Platform; SD 8 Gen1 5G; SG8275; SG8275P; SM7525; SM7550; SM8550P; Snapdragon 8 Gen 2 Mobile Platform; Snapdragon 8+ Gen 2 Mobile Platform; Snapdragon AR2 Gen 1 Platform; SSG2115P; SSG2125P; SXR1230P
qualcommfastconnect_6900_firmware<= *
qualcommfastconnect_7800_firmware<= *
qualcommqca6391_firmware<= *
qualcommqcm8550_firmware<= *
qualcommqcs7230_firmware<= *
qualcommqcs8250_firmware<= *
qualcommqcs8550_firmware<= *
qualcommqualcomm_video_collaboration_vc5_platform_firmware<= *
qualcommsd_8_gen1_5g_firmware<= *
qualcommsg8275_firmware<= *
qualcommsg8275p_firmware<= *
qualcommsm7525_firmware<= *
qualcommsm7550_firmware<= *
qualcommsm8550p_firmware<= *
qualcommsnapdragon_8_gen_2_mobile_platform_firmware<= *
qualcommsnapdragon_ar2_gen_1_platform_firmware<= *
qualcommssg2115p_firmware<= *
qualcommssg2125p_firmware<= *
qualcommsxr1230p_firmware<= *
qualcommsxr2230p_firmware<= *
qualcommsxr2250p_firmware<= *
qualcommwcd9370_firmware<= *
qualcommwcd9371_firmware<= *
qualcommwcd9375_firmware<= *
qualcommwcd9378_firmware<= *
qualcommwcd9380_firmware<= *
qualcommwcd9385_firmware<= *
qualcommwcd9390_firmware<= *
qualcommwcd9395_firmware<= *
qualcommwcn6650_firmware<= *
qualcommwcn6755_firmware<= *
qualcommwcn7880_firmware<= *
qualcommwsa8830_firmware<= *
qualcommwsa8832_firmware<= *
qualcommwsa8835_firmware<= *
qualcommwsa8840_firmware<= *
qualcommwsa8845_firmware<= *
qualcommwsa8845h_firmware<= *

References

Timeline

Published
Nov 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-233786.7Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.CVE-2024-233796.7Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.CVE-2024-23387.5PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic mCVE-2024-233807.8Memory corruption while handling user packets during VBO bind operation.CVE-2024-233817.8Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.CVE-2024-233827.8Memory corruption while processing graphics kernel driver request to create DMA fence.CVE-2024-233837.8Memory corruption when kernel driver attempts to trigger hardware fences.CVE-2024-233848.4Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.CVE-2024-233856.5Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.CVE-2024-233866.7memory corruption when WiFi display APIs are invoked with large random inputs.CVE-2024-233874.8FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attackeCVE-2024-233886.1Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker
CVE-2024-23377: Medium severity, CVSS 6.7 | Vulnix