Pierluigi Paganini December 06, 2023

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds four Qualcomm vulnerabilities to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualcomm vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

Below is the list of the issues added to the catalog:

• CVE-2023-33106 Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
• CVE-2023-33063 Qualcomm Multiple Chipsets Use-After-Free Vulnerability
• CVE-2023-33107 Qualcomm Multiple Chipsets Integer Overflow Vulnerability
• CVE-2022-22071 Qualcomm Multiple Chipsets Use-After-Free Vulnerability

The vendor addressed the flaws CVE-2023-33106, CVE-2023-33107, and CVE-2023-33063 in October 2023. The company also warned that three of the zero-day vulnerabilities were actively exploited in attacks in the wild. CVE-2022-22071 was included in our May 2022 public bulletin.

Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 were actively exploited in targeted attacks.

Google Threat Analysis Group and Google Project Zero experts focus on attacks carried out by nation-state actors or surveillance firms, this means that one of these threat actors may be behind the exploitation of the Qualcomm flaws.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by December 26, 2023.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)