CVE-2023-24850

Q: What is the severity of CVE-2023-24850?

CVE-2023-24850 has a CVSS score of 7.8 (HIGH). This vulnerability allows memory corruption in the High-Level Operating System (HLOS) when importing cryptographic keys into the KeyMaster Trusted Application on Qualcomm chipsets. Attackers could potentially execute arbitrary code or cause denial of service. Affected devices include smartphones, tablets, and IoT devices using vulnerable Qualcomm chipsets.

7.8 HIGH

📋 TL;DR

This vulnerability allows memory corruption in the High-Level Operating System (HLOS) when importing cryptographic keys into the KeyMaster Trusted Application on Qualcomm chipsets. Attackers could potentially execute arbitrary code or cause denial of service. Affected devices include smartphones, tablets, and IoT devices using vulnerable Qualcomm chipsets.

💻 Affected Systems

Products:

Qualcomm chipsets with KeyMaster TA implementation

Versions: Specific chipset firmware versions as listed in Qualcomm advisories

Operating Systems: Android and other mobile/embedded OS using Qualcomm chipsets

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices where KeyMaster Trusted Application is enabled and used for cryptographic operations.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full device compromise allowing arbitrary code execution with system privileges, potentially leading to data theft, persistent backdoors, or complete device control.

🟠

Likely Case

Application crashes, denial of service, or limited privilege escalation within the KeyMaster context.

🟢

If Mitigated

Controlled crashes or failed key import operations with no privilege escalation.

🌐 Internet-Facing: LOW - Exploitation typically requires local access or malicious app installation.

🏢 Internal Only: MEDIUM - Malicious apps or compromised processes could exploit this vulnerability locally.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires understanding of KeyMaster TA memory structures and ability to trigger key import operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to Qualcomm October 2023 security bulletin for specific chipset firmware versions

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin

Restart Required: Yes

Instructions:

1. Check device manufacturer for security updates. 2. Apply Qualcomm firmware updates. 3. Update Android security patches. 4. Reboot device after update.

🔧 Temporary Workarounds

Disable KeyMaster TA

android

Disable KeyMaster Trusted Application functionality if not required

Device-specific configuration changes - consult manufacturer documentation

🧯 If You Can't Patch

Restrict installation of untrusted applications
Implement application sandboxing and privilege separation

🔍 How to Verify

Check if Vulnerable:

Check device chipset version and firmware against Qualcomm advisory. Use 'getprop ro.boot.hardware' and 'getprop ro.build.fingerprint' on Android devices.

Check Version:

adb shell getprop | grep -E 'ro.boot.hardware|ro.build.fingerprint|ro.build.version.security_patch'

Verify Fix Applied:

Verify Android security patch level is October 2023 or later. Check with device manufacturer for specific firmware updates.

📡 Detection & Monitoring

Log Indicators:

KeyMaster TA crash logs
Cryptographic operation failures
Memory access violation in HLOS

Network Indicators:

None - local vulnerability

SIEM Query:

Search for KeyMaster-related process crashes or cryptographic service failures in device logs

📊 Metadata

CVE ID: CVE-2023-24850

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-129

Published: October 3, 2023

Last Updated: August 11, 2025

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Apq5053 Aa Firmware by Qualcomm

Apq8017 Firmware by Qualcomm

Apq8037 Firmware by Qualcomm

Apq8053 Aa Firmware by Qualcomm

Apq8053 Ac Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Home Hub 100 Platform Firmware by Qualcomm

Pm8937 Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca9379 Firmware by Qualcomm

Qcc710 Firmware by Qualcomm

Qcm2290 Firmware by Qualcomm

Qcm4290 Firmware by Qualcomm

Qcm4325 Firmware by Qualcomm

Qcm4490 Firmware by Qualcomm

Qcm6125 Firmware by Qualcomm

Qcm6490 Firmware by Qualcomm

Qcm8550 Firmware by Qualcomm

Qcn6024 Firmware by Qualcomm

Qcn6224 Firmware by Qualcomm

Qcn6274 Firmware by Qualcomm

Qcn7606 Firmware by Qualcomm

Qcn9024 Firmware by Qualcomm

Qcs2290 Firmware by Qualcomm

Qcs4290 Firmware by Qualcomm

Qcs4490 Firmware by Qualcomm

Qcs6125 Firmware by Qualcomm

Qcs6490 Firmware by Qualcomm

Qcs8550 Firmware by Qualcomm

Qdu1000 Firmware by Qualcomm

Qdu1010 Firmware by Qualcomm

Qdu1110 Firmware by Qualcomm

Qdu1210 Firmware by Qualcomm

Qdx1010 Firmware by Qualcomm

Qdx1011 Firmware by Qualcomm

Qfw7114 Firmware by Qualcomm

Qfw7124 Firmware by Qualcomm

Qru1032 Firmware by Qualcomm

Qru1052 Firmware by Qualcomm

Qru1062 Firmware by Qualcomm

Qsm8350 Firmware by Qualcomm

Qualcomm 215 Mobile Platform Firmware by Qualcomm

Sa4150p Firmware by Qualcomm

Sa4155p Firmware by Qualcomm

Sa6145p Firmware by Qualcomm

Sa6150p Firmware by Qualcomm

Sa6155 Firmware by Qualcomm