CVE-2024-21473: Qualcomm AR8035 Buffer Overflow Flaw

CVE-2024-21473 Overview

CVE-2024-21473 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw occurs when a log file is redirected to an arbitrary file location with an arbitrary file name, leading to an out-of-bounds write condition. Qualcomm disclosed the issue in its April 2024 Security Bulletin. The vulnerability is network-exploitable, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability. Affected products include Snapdragon X65/X75 5G Modem-RF, FastConnect 6900/7800, numerous IPQ and QCN networking SoCs, Immersive Home platforms, and Wi-Fi/Bluetooth firmware components.

Critical Impact
A remote, unauthenticated attacker may trigger memory corruption on hundreds of Qualcomm chipset variants used in routers, gateways, mobile modems, and IoT devices, with potential for code execution on affected firmware.

Affected Products

Qualcomm Snapdragon X65 and X75 5G Modem-RF firmware
Qualcomm FastConnect 6900 / 7800, IPQ and QCN networking SoC firmware
Qualcomm Immersive Home 214/216/316/318/326/3210 platforms and related QCA/WCD firmware

Discovery Timeline

2024-04-01 - CVE-2024-21473 published to NVD
2025-01-13 - Last updated in NVD database

Technical Details for CVE-2024-21473

Vulnerability Analysis

The vulnerability is classified under [CWE-787] Out-of-Bounds Write and [CWE-20] Improper Input Validation. It manifests in firmware logging functionality that accepts a destination path and filename for log redirection. The affected logic fails to properly validate input bounds before writing log data to the chosen location. This produces a memory corruption condition in firmware-managed memory regions. Because the affected components are deeply embedded in Qualcomm networking, modem, and connectivity stacks, exploitation can occur over network-reachable interfaces without authentication or user interaction.

Root Cause

The root cause is improper validation of caller-supplied parameters used to redirect the log file destination. When an attacker controls both the path and filename used by the logging routine, the routine writes data outside the intended buffer or to memory regions it should not modify. The combination of CWE-20 (improper input validation) and CWE-787 (out-of-bounds write) indicates the firmware does not enforce bounds or sanitize the redirection arguments before performing the write.

Attack Vector

The attack vector is network-based against affected Qualcomm chipset firmware. An attacker capable of reaching the vulnerable logging interface — for example, through services exposed by Wi-Fi, 5G modem, or networking SoC firmware in routers, gateways, modems, and connected devices — can supply crafted parameters that trigger the out-of-bounds write. Successful exploitation can corrupt firmware memory, potentially leading to denial of service or arbitrary code execution within the chipset's privileged firmware context. No verified public proof-of-concept code exists at the time of writing.

No verified exploit code is available. See the Qualcomm April 2024 Security Bulletin for technical details.

Detection Methods for CVE-2024-21473

Indicators of Compromise

Unexpected firmware crashes, watchdog resets, or reboot loops on Qualcomm-powered routers, gateways, or modems
Anomalous log files appearing in non-standard paths or with unusual filenames on affected devices
Unexplained changes in chipset firmware behavior, including dropped Wi-Fi or modem connectivity

Detection Strategies

Inventory all devices that incorporate Qualcomm chipsets listed in the April 2024 Qualcomm Security Bulletin and cross-reference firmware versions against vendor advisories
Monitor device-management consoles and syslog feeds from CPE/IoT devices for crash signatures, kernel oops messages, and firmware reset events
Correlate network telemetry for unsolicited inbound traffic targeting management or diagnostic interfaces of affected devices

Monitoring Recommendations

Centralize logs from routers, access points, and 5G gateways and alert on repeated firmware restarts or log-redirection events
Track vendor PSIRT advisories from device OEMs that integrate Qualcomm chipsets to identify when downstream patches become available
Baseline outbound traffic patterns from IoT/CPE segments and flag deviations that could indicate post-exploitation activity

How to Mitigate CVE-2024-21473

Immediate Actions Required

Apply firmware updates from Qualcomm and downstream OEMs as soon as they are released for affected products
Restrict network exposure of management, diagnostic, and logging interfaces on Qualcomm-based devices to trusted networks only
Segment IoT, CPE, and modem devices away from sensitive infrastructure to limit the blast radius of any successful exploitation

Patch Information

Qualcomm published fixes and product-specific guidance in the Qualcomm April 2024 Security Bulletin. Operators must coordinate with device OEMs to obtain integrated firmware updates, as Qualcomm distributes patches to licensees who incorporate them into end-product firmware releases.

Workarounds

Disable or firewall remote logging and diagnostic services on affected devices where operationally feasible
Enforce strict ACLs on management VLANs and block untrusted networks from reaching device administrative interfaces
Replace end-of-life Qualcomm chipset devices that will not receive vendor firmware updates from the OEM

bash

# Example: restrict management interface exposure on a Linux-based gateway
iptables -A INPUT -i wan0 -p tcp --dport 22 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP