CVE-2024-33015: Qualcomm AR8035 Firmware DoS Vulnerability

CVE-2024-33015 Overview

CVE-2024-33015 is a transient denial-of-service vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the Wi-Fi scan handling logic, specifically when parsing the Reduced Neighbor Report (RNR) Information Element (IE) received from an access point. When the bytes received from the AP are crafted such that the size of the last parameter in the IE is smaller than a neighbor report entry expects, the parser performs an out-of-bounds read.

The issue is tracked under [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read). Qualcomm disclosed the vulnerability in the August 2024 security bulletin.

Critical Impact
A remote attacker within Wi-Fi range can transmit a malformed beacon or probe response that triggers a transient denial-of-service condition on affected Qualcomm-based devices, disrupting wireless connectivity across mobile platforms, automotive systems, IoT gateways, and networking equipment.

Affected Products

Qualcomm Snapdragon mobile platforms (4/460/480/662/680/685/695/8 Gen 1/8 Gen 2/8 Gen 3 and derivatives)
Qualcomm FastConnect Wi-Fi subsystems (6200, 6700, 6900, 7800) and QCA/WCN Wi-Fi chipsets
Qualcomm IPQ networking, QCN mesh, automotive SA-series, and IoT platforms (Robotics RB5, Vision Intelligence 400, Immersive Home)

Discovery Timeline

2024-08-05 - CVE-2024-33015 published to NVD
August 2024 - Qualcomm releases fix in the Qualcomm August 2024 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33015

Vulnerability Analysis

The vulnerability lives in the WLAN firmware code path that parses the Reduced Neighbor Report Information Element during scan processing. RNR IEs are defined in the IEEE 802.11 specification and carry information about neighboring APs to help stations perform faster roaming and multi-link discovery. Each RNR IE contains one or more neighbor AP information fields with a documented minimum length.

When the parser encounters an IE whose trailing bytes do not contain a full neighbor report structure, it continues reading past the end of the actual IE buffer. This out-of-bounds read causes the WLAN subsystem to enter an inconsistent state and crash, producing a transient denial of service. Wireless connectivity drops until the subsystem restarts.

Root Cause

The root cause is missing length validation before the parser accesses the last parameter of the RNR IE. The code assumes the remaining bytes in the IE are at least as large as a neighbor report entry. When an attacker crafts an IE where the last parameter is shorter than expected, the parser reads beyond the allocated buffer, triggering [CWE-125] and [CWE-126].

Attack Vector

Exploitation requires no authentication, no user interaction, and network adjacency to the target. An attacker within Wi-Fi range operates a rogue AP or injects crafted management frames containing a malformed RNR IE. Any vulnerable Qualcomm-based station that scans and parses these frames processes the malformed IE and crashes its WLAN subsystem. The impact is limited to availability of the wireless stack — confidentiality and integrity are not affected.

// No verified proof-of-concept code is publicly available.
// The malformed IE structure follows this pattern:
//   Element ID: 201 (Reduced Neighbor Report)
//   Length:     N (attacker-controlled, chosen so that the last
//                  neighbor AP information field is truncated)
//   Neighbor AP Information[] : trailing entry shorter than the
//                               fixed minimum required by the parser
// See the Qualcomm August 2024 bulletin for firmware-level details.

Detection Methods for CVE-2024-33015

Indicators of Compromise

Repeated WLAN subsystem crashes or firmware restarts logged in device kernel or modem logs shortly after entering range of an unknown SSID
Beacon or probe response frames containing an RNR IE (Element ID 201) with a length field inconsistent with the neighbor AP information entries
Unexpected disconnects and reconnects on Qualcomm-based clients in a specific physical area, indicating a nearby rogue AP

Detection Strategies

Perform passive Wi-Fi monitoring with tools such as Wireshark or Kismet and filter for 802.11 management frames containing malformed RNR IEs
Correlate WLAN driver crash telemetry from mobile device management (MDM) and endpoint agents to identify clusters of Qualcomm devices experiencing simultaneous connectivity loss
Enable wireless intrusion detection (WIDS) rules that flag beacon and probe response frames with truncated IE payloads

Monitoring Recommendations

Ingest wireless controller and MDM telemetry into a centralized data lake to correlate device crash events with location and SSID metadata
Track firmware versions of Qualcomm-based fleet devices and alert on assets that remain on pre-August 2024 firmware
Baseline expected 802.11 management frame content in critical facilities and alert on deviations that include malformed neighbor report elements

How to Mitigate CVE-2024-33015

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm August 2024 Security Bulletin once distributed by device OEMs and carriers
Inventory all Qualcomm-based mobile, automotive, IoT, and networking assets using the CPE list to identify systems requiring patching
Prioritize patching for devices operating in high-risk wireless environments such as public spaces, transit systems, and connected vehicles

Patch Information

Qualcomm addressed the flaw in the August 2024 security bulletin. Patches propagate through OEM firmware updates for phones, automotive units, access points, and IoT devices. Consult device vendors (Google, Samsung, Xiaomi, automotive OEMs, networking vendors) for the specific firmware or OTA release that incorporates the Qualcomm fix.

Workarounds

Disable Wi-Fi scanning on unpatched devices when operating in untrusted RF environments
Restrict affected devices to trusted, controlled SSIDs and disable auto-join for open networks
Deploy wireless intrusion prevention systems (WIPS) capable of suppressing rogue APs broadcasting malformed 802.11 management frames

bash

# Example: temporarily disable Wi-Fi scanning on a Linux-based
# Qualcomm device pending firmware update
sudo nmcli radio wifi off

# Verify current firmware/driver build before and after patching
iw dev wlan0 info
ethtool -i wlan0 | grep -E 'firmware|driver'