CVE-2023-33106: Use of Out-of-range Pointer Offset in Graphics
In CISA’s Known Exploited Vulnerabilities catalog: Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Description
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-823
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
qualcomm: ar8035_firmwarequalcomm: csra6620_firmwarequalcomm: csra6640_firmwarequalcomm: fastconnect_6200_firmwarequalcomm: fastconnect_6700_firmwarequalcomm: fastconnect_6800_firmwarequalcomm: fastconnect_6900_firmwarequalcomm: fastconnect_7800_firmwarequalcomm: flight_rb5_5g_platform_firmwarequalcomm: qam8255p_firmwarequalcomm: qam8295p_firmwarequalcomm: qam8650p_firmwarequalcomm: qam8775p_firmwarequalcomm: qca6174a_firmwarequalcomm: qca6391_firmwarequalcomm: qca6426_firmwarequalcomm: qca6436_firmwarequalcomm: qca6574a_firmwarequalcomm: qca6574au_firmwarequalcomm: qca6574_firmwarequalcomm: qca6595au_firmwarequalcomm: qca6595_firmwarequalcomm: qca6696_firmwarequalcomm: qca6698aq_firmwarequalcomm: qca6797aq_firmwarequalcomm: qca8081_firmwarequalcomm: qca8337_firmwarequalcomm: qca9377_firmwarequalcomm: qcm2290_firmwarequalcomm: qcm4290_firmwarequalcomm: qcm4325_firmwarequalcomm: qcm4490_firmwarequalcomm: qcm5430_firmwarequalcomm: qcm6490_firmwarequalcomm: qcm8550_firmwarequalcomm: qcn6024_firmwarequalcomm: qcn9011_firmwarequalcomm: qcn9012_firmwarequalcomm: qcn9024_firmwarequalcomm: qcs2290_firmwarequalcomm: qcs410_firmwarequalcomm: qcs4290_firmwarequalcomm: qcs4490_firmwarequalcomm: qcs5430_firmwarequalcomm: qcs610_firmwarequalcomm: qcs6490_firmwarequalcomm: qcs7230_firmwarequalcomm: qcs8250_firmwarequalcomm: qcs8550_firmwarequalcomm: qrb5165m_firmwarequalcomm: qrb5165n_firmwarequalcomm: qualcomm_215_mobile_platform_firmwarequalcomm: qualcomm_video_collaboration_vc1_platform_firmwarequalcomm: qualcomm_video_collaboration_vc3_platform_firmwarequalcomm: qualcomm_video_collaboration_vc5_platform_firmwarequalcomm: robotics_rb5_platform_firmwarequalcomm: sa4150p_firmwarequalcomm: sa4155p_firmwarequalcomm: sa6145p_firmwareQualcomm, Inc.: Snapdragon
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)