CVE-2024-23363 Overview
CVE-2024-23363 is a transient denial-of-service vulnerability in Qualcomm WLAN firmware. The flaw occurs when the wireless stack processes an improperly formatted Fine Time Measurement (FTM) management frame. An attacker within wireless range can transmit a crafted 802.11 management frame to trigger an out-of-bounds memory access, causing the affected component to crash. The vulnerability affects hundreds of Qualcomm chipsets spanning Snapdragon mobile platforms, FastConnect Wi-Fi modules, Immersive Home access points, IPQ networking SoCs, and QCA/QCN connectivity chips. Qualcomm published the fix in the June 2024 security bulletin.
Critical Impact
Network-adjacent attackers can remotely crash Wi-Fi connectivity on Qualcomm-based devices, including Snapdragon 8 Gen 1/2/3 mobile platforms, FastConnect 6900/7800 modules, and a broad range of IPQ access point and QCN connectivity chipsets, without authentication or user interaction.
Affected Products
- Qualcomm FastConnect 6900 and FastConnect 7800 Wi-Fi/Bluetooth modules
- Qualcomm Snapdragon 8 Gen 1, Gen 2, Gen 3, and 8+ Gen 2 mobile platforms
- Qualcomm IPQ5xxx/6xxx/8xxx/9xxx networking SoCs and QCN/QCA connectivity chipsets
Discovery Timeline
- 2024-06-03 - CVE-2024-23363 published to NVD
- June 2024 - Qualcomm releases security patch in the June 2024 Security Bulletin
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23363
Vulnerability Analysis
The vulnerability is an out-of-bounds read condition classified under [CWE-125] (Out-of-bounds Read) and [CWE-126] (Buffer Over-read). It resides in the firmware code path that parses Fine Time Measurement (FTM) action frames, a feature defined in IEEE 802.11mc for ranging and positioning between Wi-Fi devices.
When a malformed FTM management frame arrives at the radio, the parser reads beyond the boundaries of the frame buffer. The resulting fault terminates the WLAN subsystem, producing a transient denial of service. The radio typically recovers after a restart of the affected component, but connectivity is interrupted for every station and access point relying on that chipset.
The attack does not require authentication, user interaction, or association with the target network. Management frames such as FTM are processed before any authentication state is established.
Root Cause
The root cause is missing or insufficient length validation on FTM management frame fields prior to parsing. The firmware trusts the size and offset metadata supplied within the frame, allowing a crafted frame to drive a read past the allocated buffer. This violates safe parsing requirements for attacker-controlled wireless input.
Attack Vector
Exploitation requires the attacker to be within wireless radio range of a vulnerable device. The attacker transmits an 802.11 action frame with malformed FTM elements addressed to the target. Because the vulnerable parsing occurs at the management-frame layer, the target does not need to be associated with the attacker. The impact is limited to availability — the affected component crashes, dropping the wireless link until recovery completes. Confidentiality and integrity are not impacted.
Detection Methods for CVE-2024-23363
Indicators of Compromise
- Repeated, unexplained WLAN subsystem resets or firmware crash logs on Qualcomm-based devices
- Sudden loss of Wi-Fi connectivity across multiple clients served by the same access point
- Presence of malformed 802.11 FTM action frames in wireless captures, particularly with inconsistent element length fields
Detection Strategies
- Monitor kernel and HAL logs (dmesg, wpa_supplicant, vendor WLAN driver logs) for repeated firmware assertions or SSR (SubSystem Restart) events tied to the WLAN core
- Use wireless intrusion detection systems (WIDS) to flag anomalous or malformed FTM (Action category 9) frames
- Correlate device crash telemetry with nearby RF activity to identify wireless-borne triggers
Monitoring Recommendations
- Centralize firmware crash and restart events from managed endpoints and access points for trend analysis
- Inventory all Qualcomm chipset firmware versions against the June 2024 Qualcomm Security Bulletin to identify unpatched assets
- Track availability metrics on wireless infrastructure to detect localized outages consistent with FTM-frame abuse
How to Mitigate CVE-2024-23363
Immediate Actions Required
- Apply the firmware update referenced in the Qualcomm Security Bulletin June 2024 through OEM channels
- Identify all devices using affected chipsets including FastConnect 6900/7800, Snapdragon 8 Gen 1/2/3, IPQ, QCN, and QCA series, then prioritize patching
- Contact device OEMs and access point vendors to confirm the availability of patched firmware images for each affected SKU
Patch Information
Qualcomm released fixes for CVE-2024-23363 in the Qualcomm Security Bulletin June 2024. The patch is distributed to downstream OEMs, who must then publish device-specific firmware or OS updates. End users must install OEM-provided updates to receive the fix.
Workarounds
- Where supported, disable 802.11mc/FTM ranging features in the wireless driver or access point configuration to remove the vulnerable code path from frame processing
- Reduce exposure in sensitive deployments by limiting wireless coverage and isolating high-value devices on segments with monitored RF perimeters
- Use management frame protection (802.11w PMF) where applicable; note that PMF does not protect pre-association action frames, so patching remains the durable fix
# Example: identify Qualcomm WLAN firmware version on Linux/Android-based devices
adb shell getprop | grep -i "wlan\|wifi\|qcom"
dmesg | grep -iE "wlan|qca|fastconnect|ssr"
# OpenWrt / IPQ platforms: check installed firmware package
opkg list-installed | grep -E "ath11k|ath10k|qca|ipq"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
