CVE-2024-23352: Qualcomm Snapdragon DoS Vulnerability

CVE-2024-23352 Overview

CVE-2024-23352 is a transient denial of service (DoS) vulnerability affecting a broad range of Qualcomm Snapdragon mobile, automotive, compute, IoT, and modem platforms. The flaw resides in the Non-Access Stratum (NAS) implementation, where the modem processes Operator Defined Access Categories (ODAC) criteria of length 1 and type 1 inside a Registration Accept message delivered over-the-air (OTA). A malformed input triggers a loop condition [CWE-835] that causes the modem to enter a transient unavailability state. The issue is exploitable from the network without authentication or user interaction.

Critical Impact
A remote attacker controlling a rogue base station or compromised network element can send a crafted Registration Accept message to disrupt cellular connectivity on affected Qualcomm-based devices.

Affected Products

Qualcomm Snapdragon 8 Gen 1/2/3, 8+ Gen 1/2, 888, 870, 865, 855, and 4 Gen 1 Mobile Platforms
Qualcomm Snapdragon X75, X72, X70, X65, X62, X55, and X35 5G Modem-RF Systems
Qualcomm FastConnect 6200/6700/6800/6900/7800, QCA, WCD, WCN, WSA, QCS, QCM, and 315 5G IoT Modem firmware

Discovery Timeline

2024-08-05 - CVE-2024-23352 published to NVD with Qualcomm August 2024 Security Bulletin
2024-11-26 - Last updated in NVD database

Technical Details for CVE-2024-23352

Vulnerability Analysis

The defect is classified as a loop with unreachable exit condition [CWE-835] inside the modem NAS layer. NAS is the 3GPP signaling sublayer responsible for mobility management and session control between the user equipment (UE) and the core network. When the modem parses an ODAC information element with length = 1 and type = 1 inside a Registration Accept Protocol Data Unit, the parser fails to terminate processing correctly. This causes the modem firmware to stall or restart, producing a transient loss of cellular service. Because Registration Accept is a downlink NAS message issued during attach and registration procedures, the malformed payload reaches the UE before mutual authentication of the higher-layer session completes.

Root Cause

The root cause is insufficient validation of an attacker-controlled length and type field within the ODAC criteria parsing routine. The parsing logic does not bound its iteration against the declared element length, leading to an infinite or excessively long loop. Confidentiality and integrity are not affected; only availability is impacted, consistent with a transient DoS outcome.

Attack Vector

Exploitation requires the attacker to deliver a malformed Registration Accept message to a target UE over the radio interface. This is typically achieved by operating a rogue or false base station within radio range of the victim, or by tampering with signaling on a controlled network segment. No user interaction, credentials, or pre-existing access to the device are required. The targeted UE will experience modem reset or temporary loss of network registration until normal operation resumes.

No public proof-of-concept exploit or weaponized tooling has been published for this issue at the time of writing.

Detection Methods for CVE-2024-23352

Indicators of Compromise

Repeated unexplained modem resets or radio interface restarts logged in device modem diagnostics (diag/QXDM traces)
Devices losing cellular registration in a specific physical area, suggesting a rogue base station operating nearby
NAS layer trace entries showing Registration Accept messages containing ODAC criteria with length 1 and type 1

Detection Strategies

Inspect modem logs for abnormal NAS state machine transitions immediately following receipt of a Registration Accept message
Correlate device-side telemetry from mobile device management (MDM) platforms with geolocation to identify clustered modem failures
Use over-the-air signaling analyzers to capture and decode NAS messages on suspect cells and flag malformed ODAC elements

Monitoring Recommendations

Forward mobile endpoint and MDM telemetry into a centralized analytics platform to surface clusters of modem instability across the fleet
Track Qualcomm firmware build numbers across managed devices and alert on devices still running pre-August 2024 baselines
Monitor public reporting of IMSI catchers and rogue base station activity in regions where corporate-issued mobile devices operate

How to Mitigate CVE-2024-23352

Immediate Actions Required

Inventory all Qualcomm Snapdragon, modem, and connectivity firmware versions across managed mobile and IoT assets
Apply OEM firmware updates incorporating the Qualcomm August 2024 security patch as soon as they are made available by the device manufacturer
Prioritize patching of high-value mobile devices and connected vehicles that operate in untrusted radio environments

Patch Information

Qualcomm released fixes for CVE-2024-23352 in the Qualcomm August 2024 Security Bulletin. The fix is delivered to end users through OEM firmware updates and carrier-distributed system images. Verify that devices receive the corresponding monthly security patch level from the device vendor.

Workarounds

Restrict use of affected devices in areas where rogue base station activity is suspected
Where supported, configure devices to prefer 5G standalone or LTE-only modes that align with the patched modem firmware build
Enforce MDM policies that flag devices running outdated firmware and quarantine them from sensitive corporate resources until updated

bash

# Example: query Android device build and security patch level via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.boot.baseband
adb shell getprop gsm.version.baseband