CVE-2024-23384: Qualcomm Wsa8845h Use-After-Free Flaw

CVE-2024-23384 Overview

CVE-2024-23384 is a memory corruption vulnerability affecting a broad range of Qualcomm chipsets and firmware components, including Snapdragon mobile, automotive, compute, and connectivity platforms. The flaw stems from a use-after-free condition [CWE-416] where mapped pages in a Virtual Buffer Object (VBO) remain mapped after being reclaimed by the memory shrinker. A local attacker with the ability to execute code on the device can trigger the condition to corrupt kernel memory, potentially leading to privilege escalation or arbitrary code execution in a privileged context.

Critical Impact
Local exploitation can lead to kernel-level memory corruption on hundreds of Qualcomm platforms, threatening confidentiality, integrity, and availability across mobile, automotive, and IoT devices.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 4 Gen 1/2, 460, 480, 662, 680, 685, 695, 8 Gen 1/2/3, 8+ Gen 1/2)
Qualcomm automotive and compute platforms (SA8155P, SA8195P, SA8255P, SA8295P, SA8650P, SA8770P, SA8775P, QCS/QCM series)
Qualcomm connectivity and audio firmware (FastConnect 6200/6700/6900/7800, WCN39xx, WCD93xx, WSA88xx)

Discovery Timeline

2024-08-05 - CVE-2024-23384 published to NVD alongside the Qualcomm August 2024 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23384

Vulnerability Analysis

The vulnerability resides in Qualcomm graphics/memory management code that manages Virtual Buffer Objects (VBOs). When memory pressure invokes the shrinker to reclaim pages backing a VBO, the reclaim path releases the underlying physical pages without first tearing down the corresponding virtual mappings. The mappings remain live and continue to reference memory that the kernel has since returned to the page allocator and reused for other purposes.

A local attacker with the ability to run unprivileged code can induce memory pressure to force the shrinker to reclaim pages that the attacker has previously mapped. Because the virtual mappings persist, subsequent reads or writes through those mappings operate on memory that now backs unrelated kernel or user objects. This produces a classic use-after-free [CWE-416] primitive against kernel-managed memory.

Root Cause

The root cause is missing synchronization between the VBO shrinker reclaim path and the buffer's page-table mappings. The shrinker frees the pages before, or without, unmapping them from the process address space and any kernel-side mappings. The buffer object's mapping lifecycle is not gated by the shrinker's reclaim decisions, breaking the invariant that a mapping must not outlive the memory it points to.

Attack Vector

Exploitation requires local code execution on the device, such as an installed application or code running with unprivileged local access. No user interaction is required. An attacker allocates and maps a VBO, applies memory pressure to trigger shrinker-based reclaim of the buffer's pages, and then continues to access the stale mapping. By racing further kernel allocations into the freed pages, the attacker can read or overwrite adjacent kernel structures to escalate privileges or execute code in kernel context. No public proof-of-concept or exploit is currently reported for CVE-2024-23384.

// No verified public exploit code is available for CVE-2024-23384.
// The vulnerability is described in prose per SentinelLabs sourcing policy.
// Refer to the Qualcomm August 2024 Security Bulletin for vendor details.

Detection Methods for CVE-2024-23384

Indicators of Compromise

Unexpected kernel panics or oops entries referencing graphics/memory subsystems, VBO handling, or shrinker callbacks in dmesg and vendor kernel logs.
Applications repeatedly allocating large graphics buffers and inducing heavy memory pressure without a legitimate workload profile.
Presence of sideloaded or unverified applications on affected Snapdragon devices with access to graphics device nodes.

Detection Strategies

Inventory endpoints, mobile devices, and embedded systems using CPE data to identify assets running affected Qualcomm firmware and correlate them with vendor patch levels.
Monitor mobile device management (MDM) telemetry for Android security patch level (SPL) values older than August 2024 on Snapdragon hardware.
Correlate crash dumps and tombstones from mobile fleets for signatures involving use-after-free in graphics driver call stacks.

Monitoring Recommendations

Track vendor OEM firmware releases that incorporate the Qualcomm August 2024 bulletin fixes and flag devices that fail to reach a patched build.
Ingest device attestation and integrity signals into a central data lake to identify devices operating on outdated firmware.
Alert on installation of applications that request low-level GPU or DMA-BUF access on unpatched devices.

How to Mitigate CVE-2024-23384

Immediate Actions Required

Apply the Qualcomm-provided patch as delivered through OEM firmware updates referenced in the Qualcomm August 2024 Security Bulletin.
Identify affected devices in the environment using the CPE list and prioritize patching for high-value assets such as automotive compute modules and enterprise mobile devices.
Restrict installation of untrusted applications on affected Snapdragon devices until the vendor patch is deployed.

Patch Information

Qualcomm addressed CVE-2024-23384 in the August 2024 security bulletin. Remediation is delivered by device OEMs as part of firmware or Android security patch level updates. Verify that the device Android SPL is dated August 5, 2024 or later, or that the OEM firmware release explicitly references the Qualcomm August 2024 bulletin fixes.

Workarounds

No vendor-supplied workaround exists; firmware update is the only complete remediation.
Enforce application allowlisting and Play Protect / vendor equivalents on managed mobile devices to reduce the local attack surface.
Segment and harden automotive, robotics, and IoT deployments so that only signed workloads can execute on affected Qualcomm platforms.

bash

# Example: check Android security patch level on an affected device via adb
adb shell getprop ro.build.version.security_patch
# Ensure the returned date is 2024-08-05 or later