CVE-2024-33014: Qualcomm 315 5G IoT Modem DOS Vulnerability

CVE-2024-33014 Overview

CVE-2024-33014 is a transient denial-of-service vulnerability affecting Qualcomm WLAN firmware across a wide range of Snapdragon, FastConnect, IPQ, QCA, and modem platforms. The flaw resides in the parser handling the Estimated Service Parameters (ESP) Information Element (IE) inside 802.11 beacon and probe response frames. An attacker within wireless range can transmit a malformed beacon or probe response that triggers an out-of-bounds read [CWE-125] and buffer over-read [CWE-126] in the WLAN stack. The result is a transient crash of the wireless subsystem on the affected device.

Critical Impact
A remote, unauthenticated attacker on adjacent wireless networks can disrupt connectivity on hundreds of Qualcomm chipset variants spanning mobile, automotive, IoT, networking, and compute platforms.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 4/6/7/8 Gen series, 460–888+, 855+, 865/870/888 5G)
Qualcomm FastConnect WLAN subsystems (6200, 6700, 6800, 6900, 7800) and QCA Wi-Fi/Bluetooth chipsets
Qualcomm IPQ networking platforms, Snapdragon Auto modems, and Snapdragon X-series 5G modem-RF systems

Discovery Timeline

2024-08-05 - CVE-2024-33014 published to NVD as part of the Qualcomm August 2024 Security Bulletin
2024-11-20 - Last updated in NVD database

Technical Details for CVE-2024-33014

Vulnerability Analysis

The vulnerability resides in the WLAN host driver code that processes Information Elements (IEs) embedded in 802.11 management frames. Specifically, the parser for the Estimated Service Parameters (ESP) IE fails to validate the length field against the actual remaining frame data before reading element contents. When a beacon or probe response frame arrives advertising an ESP IE with an inconsistent length, the parser reads beyond the allocated buffer boundary. This produces a transient denial of service as the WLAN subsystem encounters an exception, restarts, or drops the connection. CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read) describe the underlying weakness class.

Root Cause

The driver trusts the length and content fields of the ESP IE without enforcing strict bounds checking. Information Elements use a Type-Length-Value (TLV) structure, and parsers must verify that the declared length does not exceed the remaining frame buffer. The absence of this check in the ESP IE handler allows attacker-controlled values to dictate the read offset, leading to reads outside the intended buffer. No memory corruption or code execution capability is exposed, but the abnormal read condition triggers a subsystem crash.

Attack Vector

Exploitation requires the attacker to be within radio range of the target device. The adversary broadcasts a crafted beacon frame or replies with a malformed probe response containing a malformed ESP IE. Any vulnerable Qualcomm WLAN client scanning for networks—either actively or passively—will parse the frame and trigger the fault. No authentication, association, or user interaction is required. Exploitation does not require the victim to connect to the rogue access point; passive scanning is sufficient to ingest the malicious frame.

No verified public proof-of-concept is available. The vulnerability mechanism involves transmitting an 802.11 beacon or probe response where the ESP IE element ID is present but the length byte references data extending past the frame's actual payload boundary.

Detection Methods for CVE-2024-33014

Indicators of Compromise

Repeated, unexplained WLAN subsystem restarts or kernel logs showing WLAN host driver crashes referencing IE parsing routines
Loss of Wi-Fi connectivity coinciding with the presence of unfamiliar SSIDs broadcasting beacons in the vicinity
Crash dumps or dmesg entries pointing to ESP IE handling functions in the Qualcomm WLAN driver

Detection Strategies

Monitor host operating system logs (Android logcat, Linux dmesg, Windows Event Viewer) for repeated WLAN firmware or driver crashes on Qualcomm-based devices
Deploy wireless intrusion detection systems (WIDS) capable of inspecting 802.11 management frames for malformed Information Element length fields
Correlate device telemetry across endpoint fleets to identify localized clusters of WLAN failures suggesting an active attacker in proximity

Monitoring Recommendations

Capture and inspect beacon and probe response frames in high-value locations using packet captures filtered on ESP IE (element ID 0xAA) for length anomalies
Establish baselines for WLAN driver crash rates and alert on statistically significant deviations
Forward mobile device management (MDM) and endpoint telemetry to a centralized data lake for cross-fleet correlation of wireless connectivity incidents

How to Mitigate CVE-2024-33014

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm August 2024 Security Bulletin through OEM and carrier channels
Inventory all Qualcomm-based mobile, automotive, IoT, and networking assets to identify devices awaiting vendor patches
Prioritize patching for devices operating in high-risk environments such as public venues, transit hubs, and conference facilities

Patch Information

Qualcomm published fixes in the August 2024 Security Bulletin covering the full list of affected chipsets. Patches are distributed to downstream OEMs, who must integrate them into device firmware images and ship through standard update channels. Android device patch levels of 2024-08-05 or later that explicitly reference Qualcomm closed-source component fixes incorporate this remediation.

Workarounds

Disable Wi-Fi scanning and connectivity on affected devices when operating in untrusted radio environments until patches are applied
Restrict device usage to known, trusted networks and avoid environments with arbitrary 802.11 broadcast traffic where feasible
Enable enterprise WIDS controls to suppress and alert on malformed management frames in managed wireless networks

bash

# Verify Android security patch level on affected devices
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-08-05 or later for remediation