CVE-2023-33025
📋 TL;DR
This vulnerability allows memory corruption in Qualcomm's Data Modem when processing a non-standard SDP body during a VoLTE call. Attackers could potentially execute arbitrary code or cause denial of service on affected devices. This affects smartphones and other devices using vulnerable Qualcomm chipsets.
💻 Affected Systems
- Qualcomm chipsets with Data Modem functionality
📦 What is this software?
Snapdragon 680 4g Mobile Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon 680 4g Mobile Platform Firmware →
Snapdragon 685 4g Mobile Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon 685 4g Mobile Platform Firmware →
Snapdragon X65 5g Modem Rf System Firmware by Qualcomm
View all CVEs affecting Snapdragon X65 5g Modem Rf System Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent backdoor installation.
Likely Case
Device crash or reboot causing denial of service during VoLTE calls.
If Mitigated
Limited impact if patched or if VoLTE is disabled.
🎯 Exploit Status
Exploitation requires ability to send malicious VoLTE calls to target device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to January 2024 Qualcomm security bulletin
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for security updates. 2. Apply latest firmware/OS update from device vendor. 3. Reboot device after update.
🔧 Temporary Workarounds
Disable VoLTE
androidTurn off VoLTE capability to prevent exploitation via malicious calls
Settings > Network & Internet > Mobile network > VoLTE calls (toggle off)
🧯 If You Can't Patch
- Disable VoLTE functionality in device settings
- Use alternative communication methods (standard voice calls, VoIP apps)
🔍 How to Verify
Check if Vulnerable:
Check device chipset model and firmware version against Qualcomm advisoryCheck Version:
Settings > About phone > Android security patch levelVerify Fix Applied:
Verify device has January 2024 or later security patches installed📡 Detection & Monitoring
Log Indicators:
- Modem crash logs
- Unexpected VoLTE call failures
- Kernel panic related to modem
Network Indicators:
- Malformed SDP packets in VoLTE signaling
SIEM Query:
device_logs: "modem crash" OR "VoLTE failure" OR "SDP parsing error"