Pierluigi Paganini
October 04, 2023
Chipmaker Qualcomm released security updates to address 17 vulnerabilities in several components.
Three out of 17 flaws are rated Critical, 13 are rated High, and one is rated Medium in severity.
The company is also warning that three other zero-day vulnerabilities are actively exploited in attacks in the wild. Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 are actively exploited in targeted attacks.
The company plans to disclose the technical details of the actively exploited vulnerabilities in the forthcoming months.
Google Threat Analysis Group and Google Project Zero experts focus on attacks carried out by nation-state actors or surveillance firms, this means that one of these threat actors may be behind the exploitation of the Qualcomm flaws.
“There are indications from Google Threat Analysis Group and Google Project Zero that CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 may be under limited, targeted exploitation. Patches for the issues affecting Adreno GPU and Compute DSP drivers have been made available, and OEMs have been notified with a strong recommendation to deploy security updates as soon as possible. Please contact your device manufacturer for more information on the patch status about specific devices.” reads the advisory. “CVE-2022-22071 was included in our May 2022 public bulletin. The details of the remaining CVEs will be shared in our December 2023 public bulletin.”
The three critical issues fixed by the chipmaker are:
| Public ID | Security Rating | CVSS Rating | Technology Area | Date Reported |
|---|---|---|---|---|
| CVE-2023-24855 | Critical | Critical (CVSS Score 9.8) | Modem | Internal |
| CVE-2023-28540 | Critical | Critical (CVSS Score 9.1) | Data Modem | Internal |
| CVE-2023-33028 | Critical | Critical (CVSS Score 9.8) | WLAN Firmware | Internal |
There is no evidence that the above flaws have been exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Qualcomm)
