CVE-2023-33106: Use of Out-of-range Pointer Offset in Graphics

High severity · published Dec 5, 2023

CVE-2023-33106

Use of Out-of-range Pointer Offset in Graphics

In wildKEV

7.8

CVSS

0.8%

EPSS

Yes

On KEV

Description

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildYes

CISA KEVListed Dec 5, 2023

Federal remediation dueDec 26, 2023

Ransomware campaign useNot known

Affected products

Which versions

Snapdragon · Qualcomm, Inc.

AR8035; CSRA6620; CSRA6640; FastConnect 6200; FastConnect 6700; FastConnect 6800; +34 more · source: vendor

Ar8035 Firmware · Qualcomm

0 · source: NVD, CISA

Csra6620 Firmware · Qualcomm

0 · source: NVD, CISA

Csra6640 Firmware · Qualcomm

0 · source: NVD, CISA

Fastconnect 6200 Firmware · Qualcomm

0 · source: NVD, CISA

Fastconnect 6700 Firmware · Qualcomm

0 · source: NVD, CISA

Fastconnect 6800 Firmware · Qualcomm

0 · source: NVD, CISA

Fastconnect 6900 Firmware · Qualcomm

0 · source: NVD, CISA

Fastconnect 7800 Firmware · Qualcomm

0 · source: NVD, CISA

Flight Rb5 5g Platform Firmware · Qualcomm

0 · source: NVD, CISA

Qam8255p Firmware · Qualcomm

0 · source: NVD, CISA

Qam8295p Firmware · Qualcomm

0 · source: NVD, CISA

Affected product

Snapdragon

Qualcomm, Inc.

All Snapdragon CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-33106

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-33106

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

www.qualcomm.com

https://www.qualcomm.com/company/product-security/bulletins/december-2023-bulletin