CVE-2024-21481: Qualcomm AR8035 Buffer Overflow Flaw

CVE-2024-21481 Overview

CVE-2024-21481 is a memory corruption vulnerability in the Qualcomm Resource Manager. The flaw occurs when preparing a shared memory notification for a memparcel. A local attacker with low-privileged code execution on an affected device can trigger the condition to corrupt memory in a privileged component. The issue affects a broad set of Qualcomm chipsets, including Snapdragon mobile, compute, automotive, modem, and connectivity platforms. Qualcomm addressed the defect in the August 2024 Security Bulletin. The vulnerability is tracked under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-787 (out-of-bounds write).

Critical Impact
Local exploitation can lead to out-of-bounds write in the Resource Manager, enabling code execution in a privileged firmware context and full loss of confidentiality, integrity, and availability.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 670, 675, 678, 765/765G/768G, 845, 855/855+, 860, 865/865+/870, 888/888+, 8 Gen 1/2/3, 8+ Gen 2)
Qualcomm Snapdragon compute, automotive, XR/AR, and modem-RF platforms (Snapdragon 8cx family, SA8xxx auto SoCs, Snapdragon X24/X35/X50/X55/X62/X65/X72/X75, Snapdragon AR2 Gen 1, XR2 5G)
Qualcomm FastConnect, QCA, QCN, WCD, WCN, and WSA connectivity and audio firmware families

Discovery Timeline

August 5, 2024 - Qualcomm publishes the August 2024 Security Bulletin containing the fix
August 5, 2024 - CVE-2024-21481 published to the National Vulnerability Database
June 17, 2026 - Last updated in the NVD database

Technical Details for CVE-2024-21481

Vulnerability Analysis

The defect resides in the Qualcomm Resource Manager, a privileged system component that arbitrates access to shared hardware resources across subsystems. When the Resource Manager prepares a shared memory notification tied to a memparcel object, it performs buffer operations that do not correctly enforce size or boundary constraints. This mismatch results in memory corruption, classified as both improper buffer restriction ([CWE-119]) and an out-of-bounds write ([CWE-787]).

Because the affected code runs in a trusted context, corruption of adjacent memory can be steered to overwrite control data. Successful exploitation impacts confidentiality, integrity, and availability of the target system. The attack requires only local access and no user interaction, which makes it a viable post-compromise primitive for privilege escalation from a low-privileged process into a firmware or kernel-adjacent component.

Root Cause

A memparcel is a construct used to pass and share memory buffers between subsystems on Qualcomm platforms. During preparation of the notification structure, the Resource Manager writes data based on attacker-influenced parameters without adequate bounds validation. The result is an out-of-bounds write into memory the component was not permitted to modify.

Attack Vector

An attacker requires local execution on the device, for example through a compromised or malicious application. By issuing crafted requests that reach the Resource Manager's shared memory notification path, the attacker triggers the memparcel handling code and induces the memory corruption. No user interaction is required and the scope remains within the affected subsystem.

// No verified proof-of-concept is publicly available for CVE-2024-21481.
// Refer to the Qualcomm August 2024 Security Bulletin for advisory details.

Detection Methods for CVE-2024-21481

Indicators of Compromise

Unexpected crashes, reboots, or kernel panics referencing the Resource Manager, memparcel, or shared memory notification paths in dmesg, logcat, or vendor RAM dumps.
Firmware or subsystem restart events (for example, subsystem restart of the modem, ADSP, or CDSP) with no correlated legitimate cause.
Installation of unsigned or side-loaded applications that request unusual access to low-level memory or IPC interfaces prior to instability.

Detection Strategies

Inventory devices against the Qualcomm chipset list in the August 2024 bulletin and correlate installed firmware build numbers with vendor patch levels.
Monitor mobile device management (MDM) telemetry for devices that remain on pre-August 2024 Android security patch levels on affected Snapdragon SoCs.
Hunt for anomalous native crash signatures in enterprise mobility logs that reference Resource Manager or shared memory subsystems.

Monitoring Recommendations

Ingest MDM, EMM, and mobile threat defense telemetry into a centralized analytics platform to track patch compliance and repeated subsystem crashes.
Alert on newly sideloaded APKs or debug-bridged sessions on devices holding sensitive data, since local access is a prerequisite for exploitation.
Track Qualcomm and OEM security bulletin publications so downstream device patches can be validated as they land on managed fleets.

How to Mitigate CVE-2024-21481

Immediate Actions Required

Apply the Android or OEM security update that incorporates the Qualcomm August 2024 fixes to every affected device model.
For automotive, IoT, XR, and compute platforms, contact the device or module OEM to obtain firmware images that include the Qualcomm patch for CVE-2024-21481.
Restrict installation of untrusted applications on affected devices until patched firmware is deployed, since exploitation requires local code execution.

Patch Information

Qualcomm published the fix in the Qualcomm August 2024 Security Bulletin. Device manufacturers integrate these patches into their own security maintenance releases; verify that the shipped Android security patch level or firmware build corresponds to a post-August 2024 Qualcomm baseline.

Workarounds

No vendor-approved workaround exists; installing the patched firmware is the only supported remediation.
Reduce residual risk by enforcing application allowlisting, disabling developer options and USB debugging, and blocking sideloading through MDM policy.
Segment high-value mobile and embedded devices from sensitive networks until firmware confirms the Qualcomm August 2024 patch level.

bash

# Verify Android security patch level on a managed device via adb
adb shell getprop ro.build.version.security_patch
# Expected output: a date of 2024-08-01 or later, plus vendor confirmation
# that Qualcomm's August 2024 bulletin fixes are included in the build.