CVE-2023-33106: high-severity vulnerability in Qualcomm, Inc. Snapdragon
Use of Out-of-range Pointer Offset in Graphics
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
A flaw in graphics driver code allows memory corruption when a specially crafted request with too many sync points is sent to the GPU command interface, potentially causing crashes or system instability.
CWE-823 out-of-range pointer offset vulnerability in KGSL GPU AUX command IOCTL handler. Attack vector requires local access to submit malformed AUX commands with excessive sync points; memory corruption occurs due to insufficient bounds checking, leading to potential denial of service or privilege escalation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.