CVE-2024-21477: Qualcomm Aqt1000 Firmware DOS Vulnerability

CVE-2024-21477 Overview

CVE-2024-21477 is a transient denial-of-service vulnerability in Qualcomm wireless firmware. The flaw resides in the parser that processes protected 802.11az Fine Time Measurement (FTM) frames. An unauthenticated attacker within wireless range can send a malformed FTM frame to trigger the condition. The defect affects a broad set of Qualcomm Snapdragon, FastConnect, QCA, IPQ, WCN, and WCD chipsets used across smartphones, compute platforms, automotive systems, 5G modems, and Wi-Fi access points. The vulnerability maps to CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read) in the FTM frame handling code path.

Critical Impact
A remote attacker on the same wireless network can disrupt Wi-Fi connectivity on affected devices by transmitting a crafted protected 802.11az FTM frame, causing availability loss across phones, laptops, access points, and embedded systems built on Qualcomm wireless silicon.

Affected Products

Qualcomm FastConnect 6200, 6800, 6900, and 7800 Wi-Fi subsystems
Qualcomm Snapdragon 8 Gen 1/2/3, 8+ Gen 2, 855/855+/860, 765/765G/768G 5G, 720G/730/730G/732G, 678/675, 680/685 4G, 662, 460, and 7c Compute platforms
Qualcomm IPQ5xxx, IPQ6xxx, IPQ8xxx, IPQ9xxx networking and Immersive Home access point SoCs
Qualcomm QCA, QCN, QCC, WCN, WCD, and WSA wireless and audio firmware families
Qualcomm Snapdragon X50/X55/X65/X72/X75 5G Modem-RF systems and Snapdragon AR2 Gen 1

Discovery Timeline

2024-05-06 - CVE-2024-21477 published to NVD
2024-05 - Qualcomm releases fixes in the May 2024 Security Bulletin
2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-21477

Vulnerability Analysis

The defect is a transient denial of service triggered while parsing a protected 802.11az Fine Time Measurement frame. 802.11az is the next-generation Wi-Fi positioning protocol that extends FTM with cryptographic protection. Qualcomm's wireless firmware parses these frames as part of standard ranging operations. When a malformed protected FTM frame is processed, the parser reads memory outside the intended buffer boundary. The result is a firmware fault that disrupts wireless service until the affected subsystem recovers. The impact is limited to availability — the CVSS vector indicates no confidentiality or integrity compromise — but the attack requires neither authentication nor user interaction.

Root Cause

The root cause is improper bounds validation when parsing fields within a protected 802.11az FTM frame. The parser trusts length or offset values supplied in the frame and reads beyond the allocated buffer. This is consistent with the assigned weaknesses [CWE-126] Buffer Over-read and [CWE-125] Out-of-bounds Read. Because the read occurs in firmware that handles raw 802.11 frames before higher-layer validation, the condition is reachable without an established association in some configurations.

Attack Vector

The attack vector is wireless network adjacency. An attacker within radio range of a vulnerable device crafts a protected 802.11az FTM frame with malformed parameters and transmits it to the target. The Qualcomm wireless firmware parses the frame and triggers the out-of-bounds read, causing a transient denial of service on the Wi-Fi subsystem. Verified exploitation code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Qualcomm May 2024 Security Bulletin for vendor analysis.

// No verified public proof-of-concept code is available for CVE-2024-21477.
// The condition is triggered by transmitting a malformed protected
// 802.11az Fine Time Measurement frame to a vulnerable Qualcomm radio.

Detection Methods for CVE-2024-21477

Indicators of Compromise

Unexpected Wi-Fi disconnects, radio resets, or wlan firmware crash logs on Qualcomm-based devices
Kernel or HAL messages referencing FTM, 802.11az ranging, or wireless subsystem restarts in close temporal proximity
Repeated association loss correlated with the presence of an unknown nearby 802.11 transmitter advertising FTM capability

Detection Strategies

Monitor mobile device management (MDM) and endpoint telemetry for repeated Wi-Fi driver or modem subsystem crashes across multiple devices in the same physical location
Inspect wireless intrusion detection system (WIDS) logs for anomalous or malformed 802.11az FTM action frames
Correlate access point syslog events for client disconnect storms with packet captures showing FTM frame activity

Monitoring Recommendations

Enable verbose Wi-Fi subsystem logging on a representative sample of fleet devices to baseline normal FTM activity
Deploy WIDS sensors capable of decoding 802.11az management frames in areas where Qualcomm-based devices operate
Track firmware build numbers across managed endpoints and access points to confirm coverage against the May 2024 Qualcomm bulletin

How to Mitigate CVE-2024-21477

Immediate Actions Required

Apply the firmware update from your device OEM that incorporates the Qualcomm May 2024 security bulletin fix
Inventory all devices using affected Qualcomm chipsets, including phones, laptops, IoT gateways, access points, and 5G modems
Prioritize patching for devices operating in untrusted RF environments such as public spaces, guest networks, and shared office floors

Patch Information

Qualcomm published fixes in the Qualcomm May 2024 Security Bulletin. Patches are delivered through OEM firmware updates and platform security patch levels. Android device vendors typically distribute the fix through monthly security patch releases referencing the May 2024 Qualcomm advisory. Network equipment vendors using IPQ and Immersive Home platforms distribute updates through their own firmware channels.

Workarounds

Where patching is delayed, disable Wi-Fi on affected devices in high-risk RF environments to remove the attack surface
Restrict 802.11az FTM features in access point configuration where the deployment does not require Wi-Fi ranging services
Segment guest and untrusted wireless networks from production devices to limit the radio proximity of potential attackers

bash

# Example: query Android security patch level to confirm May 2024 or later coverage
adb shell getprop ro.build.version.security_patch
# Expected output should be 2024-05-01 or newer for fleet devices