CVE-2024-21453 Overview
CVE-2024-21453 is a transient denial-of-service (DoS) vulnerability affecting multiple Qualcomm firmware components. The flaw occurs while decoding a message whose size exceeds the available system memory, triggering a resource exhaustion condition that disrupts the affected component. The issue is classified under [CWE-20] Improper Input Validation. Qualcomm addressed the issue in its April 2024 Security Bulletin.
Critical Impact
A remote, unauthenticated attacker can send a crafted oversized message to trigger memory exhaustion, causing a transient denial-of-service condition on affected Qualcomm chipsets and firmware.
Affected Products
- Qualcomm C-V2X 9150 and firmware
- Qualcomm Snapdragon Auto 4G and 5G Modem-RF and firmware
- Qualcomm QCS410, QCS610, Video Collaboration VC1/VC3, WCD9341/9370, WCN3950/3980, WSA8810/8815 and firmware
Discovery Timeline
- 2024-04-01 - CVE-2024-21453 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21453
Vulnerability Analysis
The vulnerability resides in message decoding logic within affected Qualcomm firmware components. When the firmware processes an incoming message, it allocates memory based on the size field declared in the message. If the declared size exceeds the available system memory, the allocation fails or exhausts memory resources, causing the affected component to enter a transient denial-of-service state.
Because the attack vector is network-based and requires no privileges or user interaction, an attacker can reach the vulnerable parser remotely. Affected components include cellular modems, V2X (vehicle-to-everything) units, audio codecs, and connectivity chips used in automotive, IoT, and video collaboration platforms.
Root Cause
The root cause is improper input validation [CWE-20] in the message decoder. The firmware does not validate the declared message size against available system memory before attempting allocation, allowing untrusted inputs to drive resource exhaustion.
Attack Vector
A remote attacker delivers a crafted message containing a size field larger than the device can accommodate. Upon parsing, the firmware attempts the oversized allocation, exhausting memory and causing the affected service to become temporarily unresponsive. Refer to the Qualcomm April 2024 Security Bulletin for component-specific details.
Detection Methods for CVE-2024-21453
Indicators of Compromise
- Unexpected reboots, watchdog resets, or service restarts on affected Qualcomm chipsets
- Modem, V2X, or audio subsystem log entries indicating failed large memory allocations during message decoding
- Loss of cellular, V2X, or audio connectivity coincident with inbound traffic spikes
Detection Strategies
- Monitor firmware crash logs and kernel messages for allocation failures tied to message parsers
- Correlate network traffic captures with device-side denial-of-service events to identify oversized or malformed messages
- Track firmware versions across fleet inventories to confirm patch status against the Qualcomm April 2024 bulletin
Monitoring Recommendations
- Enable telemetry collection from affected devices to detect transient outages and watchdog triggers
- Apply network-level anomaly detection for unusually large protocol messages destined for cellular, V2X, or IoT endpoints
- Centralize device logs in a SIEM or data lake to baseline normal modem and V2X behavior and alert on deviations
How to Mitigate CVE-2024-21453
Immediate Actions Required
- Identify all devices using affected Qualcomm chipsets and firmware listed in the April 2024 bulletin
- Coordinate with OEMs and carriers to obtain and deploy Qualcomm-supplied firmware updates
- Restrict network exposure of vulnerable interfaces where feasible until firmware updates are applied
Patch Information
Qualcomm released fixes in the April 2024 Security Bulletin. OEMs integrate these patches into device firmware updates. Apply vendor-supplied firmware updates as they become available for each affected product line.
Workarounds
- Segment affected automotive, IoT, and collaboration devices on isolated network segments to limit attacker reach
- Apply upstream filtering to drop oversized or malformed protocol messages targeting affected services
- Disable non-essential network services on affected components until firmware patches are deployed
# Example: verify firmware version on an affected device
adb shell getprop ro.build.version.incremental
adb shell getprop ro.vendor.build.fingerprint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
