CVE-2024-33013: Qualcomm Wsa8845h Firmware DOS Vulnerability

CVE-2024-33013 Overview

CVE-2024-33013 is a transient denial-of-service vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the WLAN host driver, where the code accesses Multi-Link Information Element (ML IE) memory using an offset that can be incremented beyond the ML IE length. This out-of-bounds read condition [CWE-125, CWE-126] can be triggered remotely without authentication or user interaction, resulting in availability impact on the affected component.

The vulnerability impacts hundreds of Qualcomm products, including Snapdragon mobile platforms, FastConnect Wi-Fi modules, IPQ networking chipsets, automotive SA-series SoCs, and modem-RF systems used across mobile, automotive, IoT, and networking deployments.

Critical Impact
A network-adjacent attacker can transmit crafted Wi-Fi management frames containing malformed ML IE structures to cause a transient denial-of-service condition on the affected WLAN driver, disrupting wireless connectivity across mobile, automotive, networking, and IoT devices built on impacted Qualcomm silicon.

Affected Products

Qualcomm Snapdragon 8 Gen 2/Gen 3 and Snapdragon 8+ Gen 2 Mobile Platforms
Qualcomm FastConnect 6700, 6900, and 7800 connectivity subsystems
Qualcomm IPQ, QCN, QCA, WCN, and WSA series firmware used in routers, access points, and automotive platforms

Discovery Timeline

2024-08-05 - CVE-2024-33013 published to NVD
2024-11-26 - Last updated in NVD database

Technical Details for CVE-2024-33013

Vulnerability Analysis

The defect is a buffer over-read in the WLAN host driver's parsing of the Multi-Link Information Element introduced by IEEE 802.11be (Wi-Fi 7). When the driver processes an ML IE, it walks through sub-elements using an offset variable that is incremented as parsing progresses. The driver does not adequately validate that the running offset remains within the declared length of the ML IE buffer.

Because the parsing routine continues to read memory past the end of the ML IE structure, it accesses adjacent kernel or driver memory regions. The unexpected data interpretation triggers fault conditions in the driver, resulting in a transient denial of service that disrupts WLAN connectivity until the subsystem recovers.

Root Cause

The root cause is a missing or insufficient bounds check on the parsing offset. CWE-126 (Buffer Over-read) describes the primary weakness, and CWE-125 (Out-of-bounds Read) captures the secondary memory safety violation. The driver trusts length and offset values derived from attacker-controllable frame data without enforcing the invariant that offset < ML_IE_length before each access.

Attack Vector

Exploitation requires the attacker to be within radio range of the target device or able to inject 802.11 management frames into a path reaching the victim's WLAN interface. The attacker transmits a beacon, probe response, or association frame containing a crafted Multi-Link Information Element with inconsistent length and sub-element fields. When the victim's Qualcomm WLAN driver parses the frame, the offset is incremented beyond the ML IE length and triggers the out-of-bounds read. No authentication, user interaction, or prior association with the attacker is required.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-33013

Indicators of Compromise

Unexpected WLAN driver crashes, kernel panics, or wireless subsystem restarts on Qualcomm-based devices
Repeated loss of Wi-Fi connectivity correlated with the presence of unknown nearby 802.11 transmitters
Kernel log entries (dmesg, logcat) referencing the WLAN host driver, ML IE parsing, or memory access faults

Detection Strategies

Monitor wireless intrusion detection systems (WIDS) for malformed 802.11be management frames containing oversized or inconsistent Multi-Link Information Elements
Correlate device telemetry showing repeated WLAN service restarts with surrounding RF environment data to identify potential active exploitation
Track firmware and driver crash dumps from managed mobile, automotive, and IoT fleets for patterns consistent with ML IE parsing faults

Monitoring Recommendations

Centralize kernel and driver logs from Qualcomm-based endpoints in a SIEM or data lake for cross-device anomaly correlation
Establish baselines for normal WLAN subsystem restart frequency and alert on deviations
Inventory all devices using affected Qualcomm chipsets identified in the August 2024 Qualcomm security bulletin to scope monitoring coverage

How to Mitigate CVE-2024-33013

Immediate Actions Required

Identify all assets containing affected Qualcomm chipsets, including mobile devices, automotive head units, access points, routers, and IoT gateways
Apply OEM firmware updates that incorporate the Qualcomm August 2024 security bulletin fixes as they become available from device vendors
Restrict exposure of vulnerable WLAN interfaces to untrusted radio environments where feasible

Patch Information

Qualcomm published fixes in the Qualcomm August 2024 Security Bulletin. Because Qualcomm distributes patches through OEMs, end-user remediation depends on downstream vendors (device manufacturers, automotive OEMs, and networking equipment suppliers) shipping firmware updates that incorporate the corrected WLAN driver.

Workarounds

Disable Wi-Fi on affected devices when operating in untrusted RF environments if patches are not yet available
Where supported, disable 802.11be (Wi-Fi 7) Multi-Link Operation features at the driver or configuration level to reduce exposure to ML IE parsing
Segment wireless networks to limit the radio reachability of vulnerable client devices from untrusted transmitters

bash

# Example: temporarily disable the WLAN interface on a Linux-based device
# pending vendor firmware update
sudo ip link set wlan0 down