CVE-2024-33037

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-126

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-330387.8Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.CVE-2024-330396.7Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.CVE-2024-330407.0Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space CVE-2024-330417.8Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,CVE-2024-330427.8Memory corruption when Alternative Frequency offset value is set to 255.CVE-2024-330435.5Transient DOS while handling PS event when Program Service name length offset value is set to 255.CVE-2024-330447.8Memory corruption while Configuring the SMR/S2CR register in Bypass mode.CVE-2024-330457.8Memory corruption when BTFM client sends new messages over Slimbus to ADSP.CVE-2024-330477.8Memory corruption when the captureRead QDCM command is invoked from user-space.CVE-2024-330487.5Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.CVE-2024-330497.5Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.CVE-2024-33057.5Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedde