CVE-2024-23377
📋 TL;DR
This vulnerability allows memory corruption in Qualcomm EVA drivers when user-space applications modify packet sizes after system properties have been sent. Attackers could potentially execute arbitrary code or cause system crashes. Affects devices using vulnerable Qualcomm chipsets.
💻 Affected Systems
- Qualcomm EVA driver components
📦 What is this software?
Snapdragon 8 Gen 2 Mobile Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon 8 Gen 2 Mobile Platform Firmware →
Snapdragon 8 Gen 2 Mobile Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon 8 Gen 2 Mobile Platform Firmware →
Snapdragon Ar2 Gen 1 Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon Ar2 Gen 1 Platform Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel mode, allowing complete system compromise and persistence.
Likely Case
System instability, crashes, or denial of service affecting device functionality.
If Mitigated
Limited impact with proper access controls and sandboxing preventing user-space exploitation.
🎯 Exploit Status
Requires local access and ability to interact with driver IOCTL interface; memory corruption exploitation requires additional techniques
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm November 2024 security bulletin for specific patched versions
Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2024-bulletin.html
Restart Required: Yes
Instructions:
1. Check Qualcomm advisory for affected chipset models. 2. Obtain firmware/OS updates from device manufacturer. 3. Apply patches following manufacturer instructions. 4. Reboot system to load patched driver.
🔧 Temporary Workarounds
Restrict driver access
linuxLimit access to EVA driver device nodes to prevent unauthorized IOCTL calls
chmod 600 /dev/eva*
setfacl -m u:root:rw- /dev/eva*
🧯 If You Can't Patch
- Implement strict application sandboxing to prevent untrusted apps from accessing driver interfaces
- Monitor for suspicious IOCTL calls to EVA driver using kernel auditing
🔍 How to Verify
Check if Vulnerable:
Check Qualcomm chipset version and compare against November 2024 security bulletin affected devices listCheck Version:
cat /sys/class/misc/eva/version or check device firmware versionVerify Fix Applied:
Verify driver version after update matches patched versions in Qualcomm advisory📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Driver crash messages
- Unusual IOCTL calls to EVA driver
Network Indicators:
- Not network exploitable
SIEM Query:
source="kernel" AND ("EVA" OR "ioctl") AND ("panic" OR "corruption" OR "invalid")