CVE-2024-33018: Qualcomm Ar8035 Firmware DoS Vulnerability

CVE-2024-33018 Overview

CVE-2024-33018 is a transient denial-of-service (DoS) vulnerability affecting a broad set of Qualcomm WLAN firmware components. The flaw resides in the parser that handles the TID-to-link mapping element inside a TID-to-link mapping action frame, a control structure used by Wi-Fi 7 (802.11be) Multi-Link Operation. A malformed frame causes an out-of-bounds read condition tracked under [CWE-125] and [CWE-126], crashing the WLAN subsystem.

The issue impacts hundreds of Qualcomm products, including FastConnect 6700/6900/7800, Snapdragon 8 Gen 2 and Gen 3 mobile platforms, IPQ networking SoCs, and Snapdragon Auto platforms.

Critical Impact
An unauthenticated attacker within wireless range can transmit a crafted 802.11 action frame to crash the WLAN stack on affected Qualcomm chipsets, disrupting Wi-Fi connectivity on phones, access points, automotive units, and IoT devices.

Affected Products

Qualcomm FastConnect 6700, 6900, and 7800 Wi-Fi/Bluetooth subsystems
Snapdragon 8 Gen 2, Snapdragon 8 Gen 3, and Snapdragon 8+ Gen 2 mobile platforms
Qualcomm IPQ networking series (IPQ5010, IPQ6018, IPQ8074a, IPQ9574) and Immersive Home platforms

Discovery Timeline

2024-08-05 - CVE-2024-33018 published to NVD
2024-08-05 - Qualcomm publishes August 2024 Security Bulletin with patch information
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33018

Vulnerability Analysis

The vulnerability is an out-of-bounds read ([CWE-125]) combined with a buffer over-read of input data ([CWE-126]) in the Qualcomm WLAN firmware parsing routine for the TID-to-link mapping element. TID-to-link mapping action frames are part of the IEEE 802.11be Multi-Link Operation (MLO) feature, which allows a station to map Traffic Identifiers (TIDs) to specific radio links on a multi-link device.

When the firmware receives an action frame containing this element, it parses embedded length and bitmap fields to determine how many bytes to read for per-TID link mapping data. The parser does not adequately validate that the declared element length and internal field sizes remain within the frame boundary before dereferencing the data buffer.

Reading past the end of the received frame triggers a fault inside the WLAN firmware, producing a transient DoS. Connectivity is restored only after the WLAN subsystem recovers or the device is reset.

Root Cause

The root cause is missing or insufficient bounds checking when iterating over the variable-length TID-to-link mapping control fields. The parser trusts attacker-controlled length indicators in the action frame payload and computes pointer offsets that exceed the allocated frame buffer.

Attack Vector

Exploitation requires the attacker to be within wireless range of a vulnerable device and able to transmit raw 802.11 management or action frames. No authentication, association, or user interaction is needed because action frames can be processed prior to a fully established session. An attacker uses a Wi-Fi adapter capable of monitor and injection mode, crafts a TID-to-link mapping action frame with malformed element fields, and transmits it toward the target. The WLAN firmware crashes during parsing, dropping connectivity for all clients on an access point or the affected station itself.

No verified public proof-of-concept code has been published. The vulnerability mechanism is described in the Qualcomm Security Bulletin August 2024.

Detection Methods for CVE-2024-33018

Indicators of Compromise

Unexplained WLAN firmware crashes or wlan subsystem restarts in kernel logs on Qualcomm-based devices
Repeated client deauthentication and association failures across multiple stations associated to the same access point
Bursts of 802.11 action frames with category code 0x23 (Robust AV Streaming / Protected EHT) containing TID-to-link mapping elements from unknown source MAC addresses

Detection Strategies

Monitor wireless intrusion detection sensors for malformed 802.11be action frames carrying TID-to-link mapping elements with inconsistent length fields
Correlate device-side WLAN driver panics and cnss / wlfw subsystem restart events with concurrent RF activity captured by nearby sensors
Track baseline rates of action frame traffic per BSSID and alert on sudden spikes from non-associated source addresses

Monitoring Recommendations

Forward mobile device management (MDM) and access point diagnostic logs to a centralized analytics platform to detect firmware crash patterns at scale
Enable wireless IDS/IPS features on enterprise access points where supported and validate signature coverage for malformed 802.11be management frames
Inventory Qualcomm chipset firmware versions across endpoints, access points, IoT, and automotive assets to identify exposure scope

How to Mitigate CVE-2024-33018

Immediate Actions Required

Apply the Qualcomm WLAN firmware updates referenced in the August 2024 Security Bulletin through the device OEM or carrier update channel
Identify unmanaged or end-of-life devices using affected Qualcomm chipsets and prioritize their replacement or network segmentation
Restrict exposure of high-value access points by reducing radio power in untrusted areas and isolating guest SSIDs from production networks

Patch Information

Qualcomm published fixes for CVE-2024-33018 in the Qualcomm Security Bulletin August 2024. OEMs integrate the patched firmware into device-specific updates. Android devices typically receive the fix through monthly security patch levels of August 2024 or later; networking and automotive products receive updates through vendor-specific channels.

Workarounds

Disable 802.11be (Wi-Fi 7) Multi-Link Operation on access points where the feature is not required, eliminating the action frame path used by the vulnerable parser
Enable Management Frame Protection (802.11w / PMF) where applicable to reduce the set of frames an unauthenticated attacker can inject against associated stations
Deploy wireless intrusion prevention to automatically contain rogue transmitters generating malformed action frames near sensitive locations

bash

# Example: disable Wi-Fi 7 / EHT on a hostapd-based access point until firmware is patched
# /etc/hostapd/hostapd.conf
ieee80211be=0
ieee80211ax=1
# Enforce Protected Management Frames for associated clients
ieee80211w=2