CVE-2024-45561
📋 TL;DR
This vulnerability allows memory corruption when handling IOCTL calls from user-space to set latency levels in Qualcomm components. Attackers could potentially execute arbitrary code or cause denial of service. Affects systems using vulnerable Qualcomm hardware/drivers.
💻 Affected Systems
- Qualcomm chipsets with affected drivers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.
Likely Case
Local denial of service (system crash/instability) or limited privilege escalation within user context.
If Mitigated
Limited impact with proper access controls restricting IOCTL calls to privileged users only.
🎯 Exploit Status
Requires local access and ability to make IOCTL calls; memory corruption exploitation requires additional steps for reliable code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Qualcomm February 2025 security bulletin for specific patched versions
Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html
Restart Required: No
Instructions:
1. Check Qualcomm advisory for affected chipset/driver versions. 2. Apply vendor-provided driver/kernel updates. 3. For Android devices, wait for OEM security updates containing Qualcomm patches.
🔧 Temporary Workarounds
Restrict IOCTL access
Linux/AndroidLimit access to vulnerable IOCTL interfaces using SELinux/AppArmor policies or filesystem permissions
chmod 600 /dev/qualcomm_latency_device
setenforce 1
🧯 If You Can't Patch
- Implement strict access controls to prevent non-privileged users from making IOCTL calls
- Monitor for suspicious IOCTL activity and system crashes
🔍 How to Verify
Check if Vulnerable:
Check Qualcomm driver version against advisory; examine dmesg for IOCTL-related errors or crashesCheck Version:
cat /sys/module/qualcomm_driver/version || dmesg | grep -i qualcommVerify Fix Applied:
Verify updated driver version matches patched version in Qualcomm bulletin📡 Detection & Monitoring
Log Indicators:
- Kernel panic/OOPS messages
- IOCTL permission denied errors in system logs
- Unexpected driver crashes
Network Indicators:
- Not network exploitable
SIEM Query:
source="kernel" AND ("IOCTL" OR "qualcomm" OR "latency") AND ("panic" OR "Oops" OR "segfault")