Chipmaker Qualcomm warns of three actively exploited zero-days

Chipmaker Qualcomm addressed 17 vulnerabilities in various components and warns of three other actively exploited zero-day flaws.

Chipmaker Qualcomm released security updates to address 17 vulnerabilities in several components.

Three out of 17 flaws are rated Critical, 13 are rated High, and one is rated Medium in severity.

The company is also warning that three other zero-day vulnerabilities are actively exploited in attacks in the wild. Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 are actively exploited in targeted attacks.

The company plans to disclose the technical details of the actively exploited vulnerabilities in the forthcoming months.

Google Threat Analysis Group and Google Project Zero experts focus on attacks carried out by nation-state actors or surveillance firms, this means that one of these threat actors may be behind the exploitation of the Qualcomm flaws.

“There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 may be under limited, targeted exploitation. Patches for the issues affecting Adreno GPU and Compute DSP drivers have been made available, and OEMs have been notified with a strong recommendation to deploy security updates as soon as possible. Please contact your device manufacturer for more information on the patch status about specific devices.” reads the advisory. “CVE-2022-22071 was included in our May 2022 public bulletin. The details of the remaining CVEs will be shared in our December 2023 public bulletin.”

The three critical issues fixed by the chipmaker are:

• CVE-2023-24855: Use of Out-of-range Pointer Offset in Modem. The issue is a memory corruption in Modem while processing security related configuration before AS Security Exchange.
• CVE-2023-28540: Improper Authentication in Data Modem. The flaw is a cryptographic issue in the Data Modem caused by the improper authentication during TLS handshake.
• CVE-2023-33028: Buffer Copy without Checking Size of Input in WLAN Firmware. The flaw is a memory corruption in WLAN Firmware that occurs while doing a memory copy of pmk cache.

There is no evidence that the above flaws have been exploited in attacks in the wild.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Qualcomm)