Medium severity · published Oct 7, 2024
CVE-2024-23374
Stack-based Buffer Overflow in Power Management IC
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Snapdragon · Qualcomm, Inc.
FastConnect 6900; FastConnect 7800; QCA6174A; QCA6574AU; QCA6584AU; QCA6696; +20 more · source: vendor
F6
Fastconnect 6900 Firmware · Qualcomm
0 · source: NVD, CISA
F7
Fastconnect 7800 Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca6174a Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca6574au Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca6584au Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca6696 Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca6698aq Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca9367 Firmware · Qualcomm
0 · source: NVD, CISA
QF
Qca9377 Firmware · Qualcomm
0 · source: NVD, CISA
SF
Sa6145p Firmware · Qualcomm
0 · source: NVD, CISA
SF
Sa6150p Firmware · Qualcomm
0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23374
Vendor Advisory
https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html
More from Snapdragon
8.6
CVE-2025-21479
Incorrect Authorization in Graphics
8.6
CVE-2025-21480
Incorrect Authorization in Graphics Windows
7.8
CVE-2026-21385
Integer Overflow or Wraparound in Graphics
7.8
CVE-2024-43047
Use After Free in DSP Service
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux