CVE-2024-33010: Qualcomm Ar8035 Firmware DOS Vulnerability

CVE-2024-33010 Overview

CVE-2024-33010 is a transient denial-of-service (DoS) vulnerability affecting Qualcomm wireless firmware across hundreds of Snapdragon, FastConnect, IPQ, QCA, QCN, and Snapdragon Auto chipsets. The flaw resides in the WLAN firmware logic that parses fragments of the Multiple BSSID (MBSSID) Information Element from received 802.11 beacon frames. An attacker within radio range can broadcast a malformed beacon to trigger a use-after-free condition (CWE-416), causing the wireless subsystem to crash. The vulnerability requires no authentication or user interaction and is exploitable over the network adjacent attack surface.

Critical Impact
Unauthenticated attackers within Wi-Fi range can transmit crafted beacon frames to cause transient denial of service in the wireless stack of affected Qualcomm devices, disrupting connectivity on phones, IoT, automotive, and infrastructure platforms.

Affected Products

Qualcomm Snapdragon mobile platforms (4 Gen 1/2, 460, 480, 662, 680, 685, 695, 778G, 780G, 782G, 8 Gen 1/2/3, 8+ Gen 1/2, 888, W5+ Gen 1)
Qualcomm FastConnect 6200/6700/6900/7800 and QCA/QCN/IPQ Wi-Fi chipsets
Qualcomm Snapdragon Auto 5G Modem-RF, automotive SA-series, and Snapdragon X35/X62/X65/X72/X75 5G Modem-RF systems

Discovery Timeline

2024-08-05 - CVE-2024-33010 published to NVD
August 2024 - Qualcomm publishes Security Bulletin addressing the issue
2024-11-26 - Last updated in NVD database

Technical Details for CVE-2024-33010

Vulnerability Analysis

The vulnerability is classified as a use-after-free (CWE-416) condition in the WLAN firmware's MBSSID Information Element (IE) fragment parser. The Multiple BSSID feature, defined in IEEE 802.11, allows access points to advertise multiple virtual BSSIDs within a single beacon. When the advertised IE exceeds the maximum size, it is transmitted across multiple fragments that the receiver reassembles before processing.

The parsing routine in the affected Qualcomm firmware fails to maintain valid pointer state across fragment boundaries. When a crafted beacon frame contains specific fragmentation patterns, the firmware references memory that has already been freed during fragment reassembly. This results in a transient denial of service that crashes the wireless stack until the device or firmware subsystem recovers.

Root Cause

The root cause is improper memory lifetime management during MBSSID IE fragment processing. Pointers to fragment buffers remain in use after the underlying memory has been released, violating safe object lifecycle handling within the firmware parser.

Attack Vector

Exploitation requires an attacker to be within Wi-Fi reception range of the target device and capable of transmitting raw 802.11 beacon frames. Using a wireless adapter in monitor or AP mode with software such as hostapd or scapy, the attacker broadcasts beacons containing crafted MBSSID IE fragments. Any vulnerable device passively scanning or associated with nearby networks will parse the malicious frame and trigger the fault. No authentication, association, or user interaction is required.

Detection Methods for CVE-2024-33010

Indicators of Compromise

Unexpected WLAN firmware crashes, subsystem restarts, or wlan driver reset events in kernel logs
Repeated loss of Wi-Fi connectivity correlated with the presence of unknown SSIDs broadcasting nearby
Malformed beacon frames containing oversized or fragmented MBSSID (Element ID 71) elements captured via wireless monitoring

Detection Strategies

Deploy wireless intrusion detection systems (WIDS) to flag beacon frames with anomalous MBSSID IE fragmentation patterns
Monitor mobile device management (MDM) telemetry for repeated wireless stack restart events across managed Qualcomm-based devices
Correlate over-the-air packet captures from sensor APs with endpoint connectivity drops to identify localized attack sources

Monitoring Recommendations

Enable detailed WLAN driver logging on critical endpoints and forward dmesg and logcat events to a central log platform for analysis
Track patch compliance against the Qualcomm August 2024 Security Bulletin across all device fleets, including IoT and automotive assets
Maintain wireless sensor coverage in sensitive areas (executive offices, OT zones, vehicle fleets) to identify rogue beacon transmitters

How to Mitigate CVE-2024-33010

Immediate Actions Required

Apply the firmware updates from device OEMs incorporating the fixes referenced in the Qualcomm August 2024 Security Bulletin
Inventory affected Qualcomm-based assets, including handsets, laptops, IoT gateways, vehicle telematics units, and Wi-Fi infrastructure
Prioritize patching for devices operating in shared physical environments where attackers can broadcast within radio range

Patch Information

Qualcomm released fixes through OEM partners in the August 2024 Security Bulletin. Patches must be delivered by downstream vendors such as smartphone manufacturers, automotive integrators, and access point vendors as updated firmware images. Verify with each OEM that their release for August 2024 or later includes the MBSSID parser fix.

Workarounds

Disable Wi-Fi on impacted devices when operating in untrusted RF environments until firmware updates are applied
Restrict device exposure to public or untrusted wireless environments where attackers can transmit crafted beacons
Where supported by enterprise endpoints, configure the wireless client to prefer known SSIDs and disable passive background scanning

bash

# Example: disable Wi-Fi on a Linux endpoint until firmware is patched
nmcli radio wifi off

# Example: verify current WLAN firmware version on Android via ADB
adb shell getprop | grep -i wlan