CVE-2023-33110

Q: What is the severity of CVE-2023-33110?

CVE-2023-33110 has a CVSS score of 7.8 (HIGH). This CVE describes a race condition vulnerability in Qualcomm's PCM host voice audio driver where improper session index handling during event callbacks and PCM close operations can lead to memory corruption. The vulnerability affects devices using Qualcomm audio components and could allow attackers to execute arbitrary code or cause system crashes. This primarily impacts Android devices and other embedded systems with Qualcomm chipsets.

7.8 HIGH

📋 TL;DR

This CVE describes a race condition vulnerability in Qualcomm's PCM host voice audio driver where improper session index handling during event callbacks and PCM close operations can lead to memory corruption. The vulnerability affects devices using Qualcomm audio components and could allow attackers to execute arbitrary code or cause system crashes. This primarily impacts Android devices and other embedded systems with Qualcomm chipsets.

💻 Affected Systems

Products:

Qualcomm audio components
Android devices with Qualcomm chipsets
Embedded systems using Qualcomm audio drivers

Versions: Specific versions not detailed in references; affected versions prior to January 2024 patches

Operating Systems: Android, Linux-based systems with Qualcomm drivers

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the audio driver layer; exploitation requires access to audio subsystem APIs.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Successful exploitation could lead to arbitrary code execution with kernel privileges, potentially resulting in complete device compromise, data theft, or persistent backdoor installation.

🟠

Likely Case

Most probable impact is denial of service through system crashes or audio subsystem instability, though local privilege escalation is possible with sophisticated exploitation.

🟢

If Mitigated

With proper security controls like SELinux/AppArmor and kernel hardening, impact may be limited to denial of service or contained within sandboxed environments.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring access to the audio subsystem, not directly exploitable over network interfaces.

🏢 Internal Only: MEDIUM - Requires local access or malicious app installation, but could be exploited by malware or compromised applications on the device.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires precise timing to trigger race condition and knowledge of memory layout; likely requires local access and audio subsystem permissions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches included in January 2024 Qualcomm security bulletin

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin

Restart Required: Yes

Instructions:

1. Check device manufacturer for security updates. 2. Apply January 2024 or later Qualcomm security patches. 3. Update Android security patch level to January 2024 or later. 4. Reboot device after update.

🔧 Temporary Workarounds

Restrict audio subsystem access

linux

Limit which applications and users can access audio APIs and drivers

Disable unnecessary audio features

all

Disable voice processing or advanced audio features if not required

🧯 If You Can't Patch

Implement strict application sandboxing and privilege separation
Monitor for abnormal audio subsystem behavior or crashes

🔍 How to Verify

Check if Vulnerable:

Check Android security patch level (Settings > About phone > Android security patch level) - if before January 2024, likely vulnerable. Check Qualcomm driver versions if accessible.

Check Version:

On Android: adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Verify Android security patch level is January 2024 or later. Check with device manufacturer for specific patch verification.

📡 Detection & Monitoring

Log Indicators:

Kernel panics or crashes related to audio drivers
Audio subsystem error messages
Permission denied errors for audio device access

Network Indicators:

No direct network indicators - this is a local vulnerability

SIEM Query:

Search for: 'audio driver crash' OR 'PCM' AND 'kernel panic' OR 'segmentation fault' in system logs

📊 Metadata

CVE ID: CVE-2023-33110

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-823

Published: January 2, 2024

Last Updated: November 21, 2024

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Snapdragon 425 Mobile Platform Firmware by Qualcomm

Snapdragon 427 Mobile Platform Firmware by Qualcomm

Snapdragon 429 Mobile Platform Firmware by Qualcomm

Snapdragon 430 Mobile Platform Firmware by Qualcomm

Snapdragon 435 Mobile Platform Firmware by Qualcomm

Snapdragon 439 Mobile Platform Firmware by Qualcomm

Snapdragon 450 Mobile Platform Firmware by Qualcomm

Snapdragon 460 Mobile Platform Firmware by Qualcomm

Snapdragon 480 5g Mobile Platform Firmware by Qualcomm

Snapdragon 480 5g Mobile Platform Firmware by Qualcomm

Snapdragon 625 Mobile Platform Firmware by Qualcomm

Snapdragon 626 Mobile Platform Firmware by Qualcomm

Snapdragon 630 Mobile Platform Firmware by Qualcomm

Snapdragon 632 Mobile Platform Firmware by Qualcomm

Snapdragon 636 Mobile Platform Firmware by Qualcomm

Snapdragon 660 Mobile Platform Firmware by Qualcomm

Snapdragon 662 Mobile Platform Firmware by Qualcomm

Snapdragon 665 Mobile Platform Firmware by Qualcomm

Snapdragon 670 Mobile Platform Firmware by Qualcomm

Snapdragon 675 Mobile Platform Firmware by Qualcomm

Snapdragon 678 Mobile Platform Firmware by Qualcomm

Snapdragon 680 4g Mobile Platform Firmware by Qualcomm

Snapdragon 685 4g Mobile Platform Firmware by Qualcomm

Snapdragon 690 5g Mobile Platform Firmware by Qualcomm

Snapdragon 695 5g Mobile Platform Firmware by Qualcomm

Snapdragon 710 Mobile Platform Firmware by Qualcomm

Snapdragon 712 Mobile Platform Firmware by Qualcomm

Snapdragon 720g Mobile Platform Firmware by Qualcomm

Snapdragon 730 Mobile Platform Firmware by Qualcomm

Snapdragon 730g Mobile Platform Firmware by Qualcomm

Snapdragon 732g Mobile Platform Firmware by Qualcomm

Snapdragon 750g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 765 5g Mobile Platform Firmware by Qualcomm

Snapdragon 765g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 768g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 778g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 778g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 780g 5g Mobile Platform Firmware by Qualcomm

Snapdragon 782g Mobile Platform Firmware by Qualcomm

Snapdragon 7c Compute Platform Firmware by Qualcomm

Snapdragon 7c Gen 2 Compute Platform Firmware by Qualcomm

Snapdragon 7c\+ Gen 3 Compute Firmware by Qualcomm

Snapdragon 8 Gen 1 Mobile Platform Firmware by Qualcomm

Snapdragon 8 Gen 1 Mobile Platform Firmware by Qualcomm

Snapdragon 820 Automotive Platform Firmware by Qualcomm

Snapdragon 820 Mobile Platform Firmware by Qualcomm

Snapdragon 821 Mobile Platform Firmware by Qualcomm

Snapdragon 835 Mobile Pc Platform Firmware by Qualcomm

Snapdragon 845 Mobile Platform Firmware by Qualcomm

Snapdragon 850 Mobile Compute Platform Firmware by Qualcomm

Snapdragon 855 Mobile Platform Firmware by Qualcomm

Snapdragon 855\+\/860 Mobile Platform Firmware by Qualcomm

Snapdragon 865 5g Mobile Platform Firmware by Qualcomm

Snapdragon 865 5g Mobile Platform Firmware by Qualcomm

Snapdragon 870 5g Mobile Platform Firmware by Qualcomm

Snapdragon 888 5g Mobile Platform Firmware by Qualcomm

Snapdragon 888 5g Mobile Platform Firmware by Qualcomm

Snapdragon 8c Compute Platform Firmware by Qualcomm

Snapdragon 8c Compute Platform Firmware by Qualcomm

Snapdragon 8cx Compute Platform Firmware by Qualcomm

Snapdragon 8cx Compute Platform Firmware by Qualcomm

Snapdragon 8cx Gen 2 5g Compute Platform Firmware by Qualcomm

Snapdragon 8cx Gen 2 5g Compute Platform Firmware by Qualcomm

Snapdragon 8cx Gen 3 Compute Platform Firmware by Qualcomm

Snapdragon Ar2 Gen 1 Platform Firmware by Qualcomm

Snapdragon Auto 4g Modem Firmware by Qualcomm

Snapdragon Auto 5g Modem Rf Firmware by Qualcomm

Snapdragon W5\+ Gen 1 Wearable Platform Firmware by Qualcomm

Snapdragon Wear 1300 Platform Firmware by Qualcomm

Snapdragon Wear 2100 Platform Firmware by Qualcomm

Snapdragon Wear 2500 Platform Firmware by Qualcomm

Snapdragon Wear 3100 Platform Firmware by Qualcomm

Snapdragon Wear 4100\+ Platform Firmware by Qualcomm

Snapdragon X12 Lte Modem Firmware by Qualcomm

Snapdragon X24 Lte Modem Firmware by Qualcomm

Snapdragon X5 Lte Modem Firmware by Qualcomm

Snapdragon X50 5g Modem Rf System Firmware by Qualcomm