CVE-2024-21462

Q: What is the severity of CVE-2024-21462?

CVE-2024-21462 has a CVSS score of 7.1 (HIGH). This vulnerability allows a denial-of-service attack when loading Trusted Application (TA) ELF files on Qualcomm chipsets. It affects devices using Qualcomm processors with vulnerable firmware. Attackers can cause temporary system instability or crashes.

7.1 HIGH

Denial of Service

📋 TL;DR

This vulnerability allows a denial-of-service attack when loading Trusted Application (TA) ELF files on Qualcomm chipsets. It affects devices using Qualcomm processors with vulnerable firmware. Attackers can cause temporary system instability or crashes.

💻 Affected Systems

Products:

Qualcomm chipsets with Trusted Execution Environment (TEE) functionality

Versions: Specific firmware versions listed in Qualcomm July 2024 security bulletin

Operating Systems: Android and other OS using Qualcomm TEE

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices with Qualcomm processors that support Trusted Applications

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash requiring reboot, potentially disrupting device functionality and availability

🟠

Likely Case

Temporary denial-of-service affecting specific applications or services using TA functionality

🟢

If Mitigated

Minimal impact with proper firmware updates and security controls

🌐 Internet-Facing: MEDIUM - Requires local access or malicious app installation, but could be combined with other exploits

🏢 Internal Only: MEDIUM - Local attackers or malicious apps could trigger the vulnerability

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to load malicious TA ELF files, typically needs elevated privileges or app vulnerabilities

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware updates specified in Qualcomm July 2024 security bulletin

Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html

Restart Required: Yes

Instructions:

1. Check Qualcomm advisory for specific affected chipsets. 2. Contact device manufacturer for firmware updates. 3. Apply firmware updates through official channels. 4. Reboot device after update.

🔧 Temporary Workarounds

Restrict TA loading

all

Limit which applications can load Trusted Applications

Application sandboxing

all

Implement strict application isolation to prevent malicious TA loading

🧯 If You Can't Patch

Implement strict application vetting and security policies
Monitor for abnormal system behavior or crashes related to TA operations

🔍 How to Verify

Check if Vulnerable:

Check firmware version against Qualcomm security bulletin and device manufacturer advisories

Check Version:

Device-specific commands vary by manufacturer (e.g., Settings > About Phone on Android)

Verify Fix Applied:

Verify firmware version has been updated to patched version from manufacturer

📡 Detection & Monitoring

Log Indicators:

System crashes during TA loading
Kernel panic logs
TEE-related error messages

Network Indicators:

None - local vulnerability

SIEM Query:

Search for: 'TA loading failed', 'TEE crash', 'kernel panic' in system logs

📊 Metadata

CVE ID: CVE-2024-21462

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE: CWE-126

Published: July 1, 2024

Last Updated: November 21, 2024

🔗 References

https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html Vendor Advisory
https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

315 5g Iot Modem Firmware by Qualcomm

9205 Lte Modem Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8031 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

C V2x 9150 Firmware by Qualcomm

Csr8811 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Csrb31024 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Flight Rb5 5g Platform Firmware by Qualcomm

Fsm10056 Firmware by Qualcomm

Immersive Home 3210 Platform Firmware by Qualcomm

Immersive Home 326 Platform Firmware by Qualcomm

Ipq5300 Firmware by Qualcomm

Ipq5302 Firmware by Qualcomm

Ipq5312 Firmware by Qualcomm

Ipq5332 Firmware by Qualcomm

Ipq6000 Firmware by Qualcomm

Ipq6005 Firmware by Qualcomm

Ipq6010 Firmware by Qualcomm

Ipq6018 Firmware by Qualcomm

Ipq6028 Firmware by Qualcomm

Ipq9008 Firmware by Qualcomm

Ipq9554 Firmware by Qualcomm

Ipq9570 Firmware by Qualcomm

Ipq9574 Firmware by Qualcomm

Mdm9205s Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8620p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qamsrv1m Firmware by Qualcomm

Qca0000 Firmware by Qualcomm

Qca4004 Firmware by Qualcomm

Qca4024 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6310 Firmware by Qualcomm

Qca6335 Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6564 Firmware by Qualcomm

Qca6564a Firmware by Qualcomm

Qca6564au Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6584au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6678aq Firmware by Qualcomm

Qca6688aq Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8072 Firmware by Qualcomm

Qca8075 Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8082 Firmware by Qualcomm

Qca8084 Firmware by Qualcomm

Qca8085 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca8386 Firmware by Qualcomm

Qca9377 Firmware by Qualcomm

Qca9984 Firmware by Qualcomm