CVE-2023-33063: high-severity vulnerability in Qualcomm, Inc. Snapdragon
Use After Free in DSP Services
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
A memory error in DSP Services allows an attacker to exploit freed memory when HLOS (High-Level Operating System) communicates with the DSP processor, potentially crashing the system or executing unintended code.
Use-after-free vulnerability in DSP Services triggered via remote procedure calls from HLOS to DSP; requires ability to initiate IPC communication and results in memory corruption that may lead to denial of service or code execution in the DSP context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.