CVE-2024-23350 Overview
CVE-2024-23350 is a Denial of Service vulnerability affecting multiple Qualcomm chipsets and firmware components. The vulnerability occurs when the Downlink (DL) Non-Access Stratum (NAS) transport layer receives multiple payloads in a specific combination: one payload containing a Steering of Roaming (SOR) container with a failed integrity check, and another payload containing Location Positioning Protocol (LPP) data requiring the User Equipment (UE) to send a status message back to the network. This condition can cause a permanent denial of service on affected devices.
Critical Impact
This vulnerability enables a permanent denial of service condition on affected Qualcomm-based devices, potentially rendering mobile devices and automotive systems inoperable until physical intervention or device reset is performed.
Affected Products
- Qualcomm Snapdragon X75 5G Modem-RF System
- Qualcomm Snapdragon X72 5G Modem-RF System
- Qualcomm Snapdragon X35 5G Modem-RF System
- Qualcomm Snapdragon Auto 5G Modem-RF Gen 2
- Qualcomm Snapdragon 8 Gen 3 Mobile Platform
- Qualcomm FastConnect 7800 and 6900
- Qualcomm WSA8845H, WSA8845, WSA8840 (Smart Amplifiers)
- Qualcomm WCD9395, WCD9390, WCD9340 (Audio Codecs)
- Qualcomm QCA6698AQ, QCA6584AU, QCA6174A (Wireless Connectivity)
Discovery Timeline
- August 5, 2024 - CVE-2024-23350 published to NVD
- November 26, 2024 - Last updated in NVD database
Technical Details for CVE-2024-23350
Vulnerability Analysis
This vulnerability exists in the NAS transport layer processing logic within Qualcomm 5G modem firmware. The flaw is classified under CWE-617 (Reachable Assertion), indicating that the modem firmware encounters an assertion failure condition when processing the specific combination of malformed payloads. When a DL NAS transport message contains both a SOR container with integrity check failure and an LPP payload requiring UE response, the firmware fails to properly handle this edge case, resulting in a permanent device crash.
The attack requires adjacent network access, meaning an attacker must be within radio range of the victim device or have control over a base station or rogue cell tower. No privileges or user interaction are required to trigger the vulnerability, making it particularly dangerous in scenarios involving malicious cellular infrastructure.
Root Cause
The root cause is improper handling of concurrent NAS transport payloads with conflicting integrity states. When the SOR container integrity check fails, the firmware should gracefully reject the message. However, when combined with an LPP payload that triggers an outbound status message, the firmware enters an inconsistent state. The assertion failure (CWE-617) indicates that the code encounters a condition that developers assumed would never occur, causing the system to terminate unexpectedly rather than recovering gracefully.
Attack Vector
The attack is conducted via adjacent network access, typically through:
- Rogue Base Station Attack: An attacker sets up a malicious cellular base station (femtocell or SDR-based) within proximity to the target device
- Crafted NAS Message Delivery: The attacker transmits a specially crafted DL NAS transport message containing the malicious payload combination
- Payload Composition: The message includes a SOR container designed to fail integrity verification alongside an LPP payload that would normally require a UE response
- Device Crash: The affected modem firmware crashes permanently, requiring device restart or potentially physical intervention
The vulnerability affects the modem subsystem independently of the application processor, meaning the denial of service impacts all cellular connectivity functions.
Detection Methods for CVE-2024-23350
Indicators of Compromise
- Unexpected modem crashes or device freezes when connected to cellular networks
- Repeated modem subsystem restarts in device logs without apparent cause
- Loss of cellular connectivity in specific geographic areas (indicating possible rogue cell activity)
- Crash dumps or kernel logs showing modem assertion failures related to NAS processing
Detection Strategies
- Monitor device telemetry for modem subsystem crashes and assertion failures
- Implement cellular network anomaly detection to identify rogue base stations
- Deploy Mobile Threat Defense (MTD) solutions capable of detecting suspicious cellular behavior
- Analyze baseband logs for NAS transport processing errors or unexpected message sequences
Monitoring Recommendations
- Enable enhanced logging for modem subsystem events on managed devices
- Implement fleet-wide monitoring for coordinated modem crash patterns that may indicate active exploitation
- Correlate device crash reports with geographic locations to identify potential malicious cell sites
- Establish baseline modem stability metrics to detect anomalous crash rates
How to Mitigate CVE-2024-23350
Immediate Actions Required
- Apply firmware updates from Qualcomm and device OEMs as they become available
- Review the Qualcomm Security Bulletin August 2024 for specific patch information
- Inventory all devices using affected Qualcomm chipsets in your environment
- Prioritize updates for devices in high-risk environments such as automotive and enterprise deployments
Patch Information
Qualcomm has addressed this vulnerability in their August 2024 Security Bulletin. Device manufacturers (OEMs) are responsible for integrating and distributing firmware updates to end users. Organizations should contact their device vendors for specific patch availability timelines. The patch addresses the assertion failure condition by implementing proper error handling when processing concurrent NAS payloads with conflicting integrity states.
For detailed patch information and affected chipset specifics, refer to the Qualcomm Security Bulletin August 2024.
Workarounds
- Where feasible, limit device exposure to untrusted cellular networks until patches are applied
- Enable Wi-Fi calling as an alternative connectivity method in controlled environments
- For automotive and IoT deployments, consider network segmentation to limit impact of modem crashes
- Monitor for OEM-specific guidance as some manufacturers may provide interim mitigations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
