CVE-2024-23357

Q: What is the severity of CVE-2024-23357?

CVE-2024-23357 has a CVSS score of 6.2 (MEDIUM). This vulnerability allows an attacker to cause a denial of service (DoS) by providing a specially crafted PKCS#8-encoded RSA key with a zero-byte modulus during key import operations. Systems using affected Qualcomm components for cryptographic operations are vulnerable. The impact is limited to service disruption rather than data compromise.

6.2 MEDIUM

Denial of Service

📋 TL;DR

This vulnerability allows an attacker to cause a denial of service (DoS) by providing a specially crafted PKCS#8-encoded RSA key with a zero-byte modulus during key import operations. Systems using affected Qualcomm components for cryptographic operations are vulnerable. The impact is limited to service disruption rather than data compromise.

💻 Affected Systems

Products:

Qualcomm components with cryptographic libraries

Versions: Specific versions listed in Qualcomm August 2024 security bulletin

Operating Systems: Android, Embedded systems using Qualcomm chipsets

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems that use Qualcomm's cryptographic implementations for RSA key processing.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption of affected cryptographic functions, potentially crashing applications or services that process untrusted RSA keys.

🟠

Likely Case

Temporary service interruption when processing malicious keys, requiring restart of affected services.

🟢

If Mitigated

Minimal impact with proper input validation and error handling in place.

🌐 Internet-Facing: MEDIUM - Only affects systems that accept untrusted RSA keys from external sources.

🏢 Internal Only: LOW - Requires specific conditions where internal systems process malicious keys.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires ability to provide malicious RSA keys to vulnerable systems.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions specified in Qualcomm August 2024 security bulletin

Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html

Restart Required: Yes

Instructions:

1. Check Qualcomm security bulletin for affected components. 2. Apply vendor-provided firmware/software updates. 3. Restart affected devices/services.

🔧 Temporary Workarounds

Input validation for RSA keys

all

Implement validation to reject RSA keys with zero-byte modulus before processing

Isolate key processing

all

Run cryptographic operations in isolated containers/processes with restart capabilities

🧯 If You Can't Patch

Implement strict input validation for all RSA key imports
Monitor and restart services that handle cryptographic operations if they crash

🔍 How to Verify

Check if Vulnerable:

Check device firmware/software version against Qualcomm security bulletin

Check Version:

Device-specific commands to check Qualcomm component versions

Verify Fix Applied:

Verify updated version is installed and test RSA key import functionality

📡 Detection & Monitoring

Log Indicators:

Cryptographic service crashes
Failed RSA key import attempts
Unexpected process terminations

Network Indicators:

Multiple failed key import attempts from single source

SIEM Query:

Process termination events from cryptographic services OR failed authentication attempts with key import errors

📊 Metadata

CVE ID: CVE-2024-23357

CVSS v3 Score: 6.2 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: August 5, 2024

Last Updated: November 25, 2024

🔗 References

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

215 Mobile Platform Firmware by Qualcomm

Apq8017 Firmware by Qualcomm

Apq8037 Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Flight Rb5 5g Platform Firmware by Qualcomm

Home Hub 100 Platform Firmware by Qualcomm

Pm8937 Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8620p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qamsrv1m Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6584au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6678aq Firmware by Qualcomm

Qca6688aq Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca9379 Firmware by Qualcomm

Qcc710 Firmware by Qualcomm

Qcm2150 Firmware by Qualcomm

Qcm2290 Firmware by Qualcomm

Qcm4290 Firmware by Qualcomm

Qcm4325 Firmware by Qualcomm

Qcm4490 Firmware by Qualcomm

Qcm5430 Firmware by Qualcomm

Qcm6125 Firmware by Qualcomm

Qcm6490 Firmware by Qualcomm

Qcm8550 Firmware by Qualcomm

Qcn6024 Firmware by Qualcomm

Qcn6224 Firmware by Qualcomm

Qcn6274 Firmware by Qualcomm

Qcn7606 Firmware by Qualcomm

Qcn9011 Firmware by Qualcomm

Qcn9012 Firmware by Qualcomm

Qcn9024 Firmware by Qualcomm

Qcs2290 Firmware by Qualcomm

Qcs4290 Firmware by Qualcomm

Qcs4490 Firmware by Qualcomm

Qcs5430 Firmware by Qualcomm

Qcs6125 Firmware by Qualcomm

Qcs6490 Firmware by Qualcomm

Qcs7230 Firmware by Qualcomm

Qcs8250 Firmware by Qualcomm

Qcs8550 Firmware by Qualcomm

Qdu1000 Firmware by Qualcomm

Qdu1010 Firmware by Qualcomm

Qdu1110 Firmware by Qualcomm

Qdu1210 Firmware by Qualcomm

Qdx1010 Firmware by Qualcomm

Qdx1011 Firmware by Qualcomm

Qep8111 Firmware by Qualcomm