CVE-2023-33025: Critical Buffer Overflow Vulnerability in Qualcomm Modems

Vulnerability Summary

• CVE ID: CVE-2023-33025​

• Severity: Critical (CVSS 3.1 Score: 9.8)​

• Attack Vector: Network​

• Privileges Required: None​

• User Interaction: None​

• Impact: Remote Code Execution (RCE)​

CVE-2023-33025 is a critical buffer overflow vulnerability in Qualcomm’s data modem component. The flaw arises when a non-standard Session Description Protocol (SDP) body is processed during a Voice over LTE (VoLTE) call, leading to memory corruption. Exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected device. ​

Affected Products

This vulnerability affects multiple Qualcomm chipsets, including:​

• Snapdragon 680​

• Snapdragon 685​

• Snapdragon X65 5G Modem​

• Snapdragon X70 Modem RF Systems​

These chipsets are used in various devices from manufacturers such as Samsung, Motorola, and Huawei.

Exploitation Details

An attacker could exploit this vulnerability by sending a specially crafted VoLTE call containing a malformed SDP body. When the target device processes this call, the malformed SDP can trigger a buffer overflow in the modem’s memory, potentially allowing the attacker to execute arbitrary code. However, successful exploitation would likely require the attacker to have control over or access to the LTE network infrastructure. ​

Mitigation Recommendations

• Apply Patches: Qualcomm has released patches to address this vulnerability. Device manufacturers have been provided with these patches and are expected to distribute them through firmware updates. ​

• Update Devices: Users should ensure their devices are updated to the latest firmware versions provided by their device manufacturers.​

• Use Trusted Networks: Avoid connecting to untrusted or unknown LTE networks, as exploitation may require control over the network infrastructure.​

Conclusion

CVE-2023-33025 poses a significant risk due to its potential for remote code execution without user interaction. Given the severity and the wide range of affected devices, it is crucial for users and organizations to apply the necessary updates promptly and follow best practices to mitigate potential exploitation.​

References

• NVD – CVE-2023-33025​

• Qualcomm January 2024 

• SC Media Report on CVE-2023-33025​

• Android Security Bulletin – January 2024