EUVD-2024-54640
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
Analysis
Memory corruption vulnerability in Qualcomm's Virtual Machine (VM) attachment mechanism that occurs when the Host Linux OS (HLOS) retains access to a VM during attachment operations. This local privilege escalation vulnerability affects Qualcomm System-on-Chip (SoC) implementations and allows a local attacker with user-level privileges to achieve code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has not been reported as actively exploited in the KEV catalog, but the high CVSS score (7.8) and local attack vector indicate significant real-world risk for deployed Qualcomm-based devices.
Technical Context
This vulnerability resides in Qualcomm's hypervisor or virtualization management layer, specifically in the VM attachment process. The root cause is classified as CWE-284 (Improper Access Control / Improper Resource Validation), indicating insufficient validation of access controls when transitioning VM states during attachment. The flaw occurs in the interaction between HLOS (High-Level Operating System, typically Android or Linux) and the Qualcomm TEE/hypervisor when a VM is being attached to system resources. The HLOS should relinquish access to VM memory/resources during attachment, but improper state management allows the HLOS to retain access simultaneously, creating a race condition or use-after-free scenario in kernel memory. Affected CPE strings would encompass Qualcomm Snapdragon processors and SoCs used in Android devices, though specific version identifiers require vendor advisories. The vulnerability likely affects the QEMU-based virtualization extensions or Qualcomm's proprietary hypervisor implementations on ARM64 architectures.
Affected Products
Qualcomm System-on-Chip (SoC) implementations featuring hypervisor/virtualization support, primarily: (1) Snapdragon 8 Gen 3 and earlier flagship SoCs; (2) Mid-range Snapdragon 7+ Gen 2 and earlier; (3) Android devices running QEMU-based virtualization or Qualcomm's hypervisor; (4) Specific CPE coverage likely includes: qualcomm:snapdragon (all versions with TEE/hypervisor), qualcomm:adreno_gpu (virtualization-enabled variants). Vendor advisory from Qualcomm Security Bulletin would specify exact affected product lines (e.g., SM8550, SM8450, SM7675). Affected configurations include: Android 13-14 with hypervisor enabled, QEMU instances on Qualcomm hardware, and any virtualization-based security feature (like Guarded VM or Protected VM). OEM customizations may differ, but core vulnerability affects Qualcomm reference designs.
Remediation
Qualcomm patch: (1) Contact Qualcomm for Security Bulletin update containing patched hypervisor/HLOS VM attachment code—patches typically released via OTA updates or Android security patches; (2) Specific patch details: firmware/bootloader update containing corrected VM state machine logic to enforce strict HLOS access revocation before VM attachment completion; (3) Interim mitigations (if patch unavailable): (a) Disable virtualization features in BIOS/bootloader if not required; (b) Restrict shell access (PR:L requirement means unprivileged users can exploit—restrict sudo/shell to trusted users only); (c) Monitor system logs for memory corruption signatures (kernel panics, segmentation faults during VM operations); (4) For OEMs/device manufacturers: apply Qualcomm's microcode/firmware patches to device builds and release OTA updates promptly; (5) Enterprise mitigation: enforce Mobile Device Management (MDM) policies restricting app installation and system access; update to latest Android Security Patch Level. Vendors should reference official Qualcomm Security Bulletin (CVE-2024-53010 advisory) for signed patches and timeline.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today