What is the CVSS score of EUVD-2024-54640?

EUVD-2024-54640 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Qca8081 Firmware are affected by EUVD-2024-54640?

CVE-2024-53010 is a high-severity memory corruption vulnerability affecting virtual machine attachment operations that could allow attackers to compromise system stability or gain unauthorized…

How to fix or mitigate EUVD-2024-54640?

Within 24 hours: Inventory all systems running affected hypervisor versions and assess VM attachment frequency in production environments. Within 7 days: Implement network segmentation to restrict VM management access to trusted administrative networks only, and disable VM attachment features if operationally feasible. Within 30 days: Establish continuous monitoring for suspicious VM attachment activities, coordinate with the vendor for patch timeline, and develop a patching deployment plan for immediate execution once available.

Qca8081 Firmware EUVD-2024-54640

| CVE-2024-53010 HIGH

Improper Access Control (CWE-284)

2025-06-03 product-security@qualcomm.com

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54640

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 7.8

DescriptionCVE.org

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

AnalysisAI

Memory corruption vulnerability in Qualcomm's Virtual Machine (VM) attachment mechanism that occurs when the Host Linux OS (HLOS) retains access to a VM during attachment operations. This local privilege escalation vulnerability affects Qualcomm System-on-Chip (SoC) implementations and allows a local attacker with user-level privileges to achieve code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has not been reported as actively exploited in the KEV catalog, but the high CVSS score (7.8) and local attack vector indicate significant real-world risk for deployed Qualcomm-based devices.

Technical ContextAI

This vulnerability resides in Qualcomm's hypervisor or virtualization management layer, specifically in the VM attachment process. The root cause is classified as CWE-284 (Improper Access Control / Improper Resource Validation), indicating insufficient validation of access controls when transitioning VM states during attachment. The flaw occurs in the interaction between HLOS (High-Level Operating System, typically Android or Linux) and the Qualcomm TEE/hypervisor when a VM is being attached to system resources. The HLOS should relinquish access to VM memory/resources during attachment, but improper state management allows the HLOS to retain access simultaneously, creating a race condition or use-after-free scenario in kernel memory. Affected CPE strings would encompass Qualcomm Snapdragon processors and SoCs used in Android devices, though specific version identifiers require vendor advisories. The vulnerability likely affects the QEMU-based virtualization extensions or Qualcomm's proprietary hypervisor implementations on ARM64 architectures.

RemediationAI

Qualcomm patch: (1) Contact Qualcomm for Security Bulletin update containing patched hypervisor/HLOS VM attachment code—patches typically released via OTA updates or Android security patches; (2) Specific patch details: firmware/bootloader update containing corrected VM state machine logic to enforce strict HLOS access revocation before VM attachment completion; (3) Interim mitigations (if patch unavailable): (a) Disable virtualization features in BIOS/bootloader if not required; (b) Restrict shell access (PR:L requirement means unprivileged users can exploit—restrict sudo/shell to trusted users only); (c) Monitor system logs for memory corruption signatures (kernel panics, segmentation faults during VM operations); (4) For OEMs/device manufacturers: apply Qualcomm's microcode/firmware patches to device builds and release OTA updates promptly; (5) Enterprise mitigation: enforce Mobile Device Management (MDM) policies restricting app installation and system access; update to latest Android Security Patch Level. Vendors should reference official Qualcomm Security Bulletin (CVE-2024-53010 advisory) for signed patches and timeline.