Qualcomm patches actively exploited flaw in DSP Service in their chipsets
Take action: One exploited flaw and one critical in Quallcom chips. It's wise to apply the Android patch as soon as your vendor releases an update for your phone. Depending on the vendor you might wait for some weeks/months before the update is released for your phone. But don't skip these updates - especially if you are working in sensitive professions requiring security of your devices.
Learn More
Qualcomm has released security patches for a critical zero-day vulnerability, affecting its Digital Signal Processor (DSP) service across numerous chipsets.
This flaw, tracked as CVE-2024-43047 (CVSS score 7.8) is a use-after-free vulnerability that can lead to memory corruption. The use-after-free flaw arises when the DSP kernel improperly manages DMA handle file descriptors (FDs). During the handling of these FDs, if invalid or reused descriptors are processed, it can result in a memory corruption situation. The vulnerability allows local attackers with low privileges to manipulate these FDs, potentially leading to unauthorized code execution.
Google's Threat Analysis Group (TAG) and Amnesty International have flagged this issue as exploited in the wild, likely in targeted spyware attacks against high-risk individuals such as journalists and political dissidents.
Alongside CVE-2024-43047, Qualcomm also patched a critical flaw CVE-2024-33066 (CVSS score 9.8) in its WLAN Resource Manager. This flaw is attributed to improper input validation and can result in memory corruption.
Users should ensure their devices are updated with the latest patches as soon as possible.
