CVE-2024-21461: Qualcomm 315 5G IoT Use-After-Free Flaw

CVE-2024-21461 Overview

CVE-2024-21461 is a Double Free vulnerability affecting Qualcomm chipset firmware across a broad range of mobile, automotive, IoT, and wearable platforms. The vulnerability occurs during HMAC (Hash-based Message Authentication Code) cryptographic operations when the keymaster component prematurely frees a memory context that is subsequently accessed or freed again. This memory corruption issue can allow a local attacker with low privileges to potentially execute arbitrary code, escalate privileges, or cause system instability on affected devices.

Critical Impact

Successful exploitation of this Double Free vulnerability could allow attackers with local access to achieve code execution, privilege escalation, or denial of service on hundreds of Qualcomm-powered devices spanning smartphones, automotive systems, IoT devices, and wearables.

Affected Products

• Qualcomm Snapdragon 8 Gen 1/2/3 Mobile Platforms
• Qualcomm Snapdragon 800/700/600/400 Series Mobile Platforms
• Qualcomm Automotive Platforms (SA8155P, SA8195P, SA8255P, SA8775P)
• Qualcomm FastConnect 6200/6700/6800/6900/7800 Firmware
• Qualcomm Snapdragon XR1/XR2 5G Platforms
• Qualcomm Snapdragon Wear 4100+ and W5+ Gen 1 Wearable Platforms
• Qualcomm 315 5G IoT Modem and 9205 LTE Modem Firmware
• Qualcomm Robotics RB3/RB5 Platforms

Discovery Timeline

• July 1, 2024 - CVE-2024-21461 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21461

Vulnerability Analysis

This vulnerability is classified as CWE-415 (Double Free), a memory corruption issue that occurs when a program attempts to free the same memory location twice. In the context of CVE-2024-21461, the flaw manifests within Qualcomm's keymaster component during HMAC cryptographic operations.

The keymaster is a critical security component responsible for managing cryptographic keys and performing secure operations within the Trusted Execution Environment (TEE). When performing the finish operation for HMAC calculations, the code improperly manages the memory context lifecycle. The context structure is freed prematurely, but subsequent code paths continue to reference or attempt to free this same memory region.

Double Free vulnerabilities are particularly dangerous because they can corrupt heap metadata, leading to:

• Arbitrary write primitives when the allocator reuses the freed memory
• Control flow hijacking if function pointers within the corrupted structures are overwritten
• Privilege escalation from the normal world to the secure world in ARM TrustZone environments

The local attack vector requires an attacker to have code execution on the device, but the low privilege requirement means even unprivileged applications could potentially trigger the vulnerability through keymaster API calls.

Root Cause

The root cause of this vulnerability lies in improper memory lifecycle management within the keymaster's HMAC operation handler. When the finish operation is called to complete an HMAC computation, the code path responsible for cleaning up the cryptographic context does not properly track whether the context has already been freed.

This can occur due to:

• Missing state flags that track whether context memory has been released
• Error handling paths that free memory but don't update context state
• Race conditions between concurrent HMAC operations sharing context structures
• Improper reference counting on the context object

The keymaster operates within the TEE, making exploitation potentially more impactful as it could compromise the secure world's integrity.

Attack Vector

The attack vector for CVE-2024-21461 is local, requiring an attacker to have code execution capability on the target device. The exploitation process involves:

1. Initial Access: The attacker must first gain code execution on the device, potentially through a malicious application or by exploiting another vulnerability
2. Trigger Condition: The attacker initiates HMAC operations through the keymaster API, crafting requests designed to trigger the premature context free condition
3. Heap Manipulation: By controlling heap allocation patterns before and after the Double Free, the attacker can influence what data occupies the freed memory region
4. Exploitation: When the memory is freed a second time or accessed after being reallocated, the attacker can achieve arbitrary memory writes or code execution

The vulnerability does not require any user interaction, making it suitable for automated exploitation once initial code execution is achieved.

Detection Methods for CVE-2024-21461

Indicators of Compromise

• Unexpected device crashes or reboots, particularly during cryptographic operations
• Unusual keymaster process behavior or repeated keymaster service restarts
• Memory corruption indicators in system logs referencing TEE or trustzone components
• Anomalous HMAC operation patterns in security audit logs

Detection Strategies

• Monitor for abnormal patterns in keymaster API calls, particularly repeated or malformed HMAC finish operations
• Deploy memory integrity monitoring solutions that can detect heap corruption attempts
• Implement runtime application self-protection (RASP) to detect exploitation attempts against keymaster interfaces
• Review device firmware versions against the affected product list in the Qualcomm security bulletin

Monitoring Recommendations

• Enable enhanced logging for TEE and keymaster operations where supported by the device
• Monitor system stability metrics for unexplained crashes that may indicate exploitation attempts
• Implement behavioral analysis to detect applications making suspicious cryptographic API calls
• Deploy endpoint detection solutions capable of monitoring low-level system interactions

How to Mitigate CVE-2024-21461

Immediate Actions Required

• Review all deployed devices against the extensive list of affected Qualcomm chipsets
• Apply firmware updates from device manufacturers as they become available
• Prioritize patching for devices in high-security environments or with sensitive data
• Implement additional access controls to limit which applications can invoke keymaster operations

Patch Information

Qualcomm has addressed this vulnerability in their July 2024 Security Bulletin. Organizations should:

1. Consult the Qualcomm July 2024 Security Bulletin for detailed patch information
2. Contact device OEMs (Original Equipment Manufacturers) for firmware update availability
3. For Android devices, monitor monthly Android Security Bulletins for patch integration
4. For automotive and IoT deployments, coordinate with Qualcomm directly for embedded system updates

Due to the wide range of affected products spanning mobile, automotive, IoT, and wearable platforms, patch deployment timelines will vary significantly based on the device manufacturer and deployment environment.

Workarounds

• Limit application installation to trusted sources to reduce the risk of malicious code execution
• Implement Mobile Device Management (MDM) policies to control which applications can run on affected devices
• Enable additional security features such as SELinux enforcement and sandboxing where available
• Consider network isolation for IoT and automotive devices until patches are available

# Check Android Security Patch Level (for Android devices)
adb shell getprop ro.build.version.security_patch

# Verify firmware version against affected products
adb shell getprop ro.board.platform
adb shell cat /sys/devices/soc0/soc_id