CVE-2023-33032

Q: What is the severity of CVE-2023-33032?

CVE-2023-33032 has a CVSS score of 9.3 (CRITICAL). This vulnerability allows memory corruption in the TrustZone Secure OS when requesting memory allocation from the Trusted Application region. It affects Qualcomm chipsets with TrustZone technology, potentially enabling attackers to execute arbitrary code in the secure environment. This impacts mobile devices, IoT devices, and embedded systems using affected Qualcomm hardware.

9.3 CRITICAL

📋 TL;DR

This vulnerability allows memory corruption in the TrustZone Secure OS when requesting memory allocation from the Trusted Application region. It affects Qualcomm chipsets with TrustZone technology, potentially enabling attackers to execute arbitrary code in the secure environment. This impacts mobile devices, IoT devices, and embedded systems using affected Qualcomm hardware.

💻 Affected Systems

Products:

Qualcomm chipsets with TrustZone technology

Versions: Multiple Qualcomm SoCs and firmware versions prior to January 2024 patches

Operating Systems: Android, Linux-based embedded systems

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using Qualcomm's TrustZone implementation. Specific chipset models listed in Qualcomm bulletins.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the TrustZone secure environment, allowing attackers to bypass hardware security features, extract encryption keys, manipulate secure boot, and gain persistent root access to the device.

🟠

Likely Case

Privilege escalation from Android/Linux userland to TrustZone secure world, enabling extraction of sensitive data like biometric templates, payment credentials, and DRM keys.

🟢

If Mitigated

Limited impact if devices have proper memory isolation and exploit mitigations, though TrustZone compromise remains serious.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires local access and knowledge of TrustZone internals. No public exploits known as of January 2024.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: January 2024 security patches from Qualcomm

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin

Restart Required: Yes

Instructions:

1. Check with device manufacturer for firmware updates. 2. Apply Qualcomm January 2024 security patches. 3. Update device firmware through official channels. 4. Reboot device after update.

🔧 Temporary Workarounds

Restrict TrustZone access

android

Limit which applications can interact with TrustZone services

Enhanced monitoring

all

Monitor for unusual TrustZone service calls or memory allocation patterns

🧯 If You Can't Patch

Isolate affected devices from untrusted networks
Implement strict application whitelisting to prevent malicious code execution

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against Qualcomm's patched versions list. Use 'getprop ro.build.fingerprint' on Android to check build date.

Check Version:

On Android: adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Verify firmware version includes January 2024 or later security patches. Check with device manufacturer for specific patch verification.

📡 Detection & Monitoring

Log Indicators:

Unusual TrustZone service calls
Memory allocation failures in secure world
Unexpected secure world crashes

Network Indicators:

None - this is a local vulnerability

SIEM Query:

Search for TrustZone-related error codes or secure world exceptions in device logs

📊 Metadata

CVE ID: CVE-2023-33032

CVSS v3 Score: 9.3 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-190

Published: January 2, 2024

Last Updated: November 21, 2024

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

9205 Lte Modem Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8031 Firmware by Qualcomm

C V2x 9150 Firmware by Qualcomm

Csr8811 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Csrb31024 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fsm10056 Firmware by Qualcomm

Ipq6000 Firmware by Qualcomm

Ipq6005 Firmware by Qualcomm

Ipq6010 Firmware by Qualcomm

Ipq6018 Firmware by Qualcomm

Ipq6028 Firmware by Qualcomm

Ipq9008 Firmware by Qualcomm

Ipq9574 Firmware by Qualcomm

Qca4004 Firmware by Qualcomm

Qca4024 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6564 Firmware by Qualcomm

Qca6564a Firmware by Qualcomm

Qca6564au Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca8072 Firmware by Qualcomm

Qca8075 Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8082 Firmware by Qualcomm

Qca8084 Firmware by Qualcomm

Qca8085 Firmware by Qualcomm

Qca8386 Firmware by Qualcomm

Qca9377 Firmware by Qualcomm

Qcm6125 Firmware by Qualcomm

Qcn5021 Firmware by Qualcomm

Qcn5022 Firmware by Qualcomm

Qcn5052 Firmware by Qualcomm

Qcn5121 Firmware by Qualcomm

Qcn5122 Firmware by Qualcomm

Qcn5152 Firmware by Qualcomm

Qcn6023 Firmware by Qualcomm

Qcn6024 Firmware by Qualcomm

Qcn9000 Firmware by Qualcomm

Qcn9022 Firmware by Qualcomm

Qcn9024 Firmware by Qualcomm

Qcn9070 Firmware by Qualcomm

Qcn9072 Firmware by Qualcomm

Qcn9074 Firmware by Qualcomm

Qcn9274 Firmware by Qualcomm

Qcs410 Firmware by Qualcomm

Qcs610 Firmware by Qualcomm

Qcs6125 Firmware by Qualcomm

Qcs8155 Firmware by Qualcomm

Qts110 Firmware by Qualcomm

Sa4150p Firmware by Qualcomm

Sa4155p Firmware by Qualcomm

Sa6145p Firmware by Qualcomm

Sa6150p Firmware by Qualcomm

Sa6155 Firmware by Qualcomm

Sa6155p Firmware by Qualcomm

Sa8145p Firmware by Qualcomm

Sa8150p Firmware by Qualcomm

Sa8155 Firmware by Qualcomm

Sa8155p Firmware by Qualcomm

Sa8195p Firmware by Qualcomm

Sc8180x\+sdx55 Firmware by Qualcomm

Sd 675 Firmware by Qualcomm

Sd675 Firmware by Qualcomm

Sd730 Firmware by Qualcomm