CVE-2024-33019 Overview
CVE-2024-33019 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the WLAN stack and is triggered while parsing a received Traffic Identifier (TID)-to-link mapping action frame, a control element introduced for Wi-Fi 7 multi-link operation. An attacker within wireless range can transmit a malformed action frame that causes the receiver to crash or restart its WLAN subsystem. Qualcomm disclosed the issue in its August 2024 Security Bulletin. The weakness is classified under CWE-125 (Out-of-Bounds Read) and CWE-126 (Buffer Over-read).
Critical Impact
A remote, unauthenticated attacker on the wireless network can disrupt connectivity on hundreds of Qualcomm-based mobile, automotive, networking, and IoT products by sending a crafted TID-to-link mapping action frame.
Affected Products
- Qualcomm Snapdragon 8 Gen 2, Gen 3, and 8+ Gen 2 Mobile Platforms
- Qualcomm FastConnect 6700, 6900, and 7800 Wi-Fi/Bluetooth subsystems
- Qualcomm IPQ, QCN, and Immersive Home networking platforms and automotive SA-series firmware
Discovery Timeline
- 2024-08-05 - CVE-2024-33019 published to NVD
- 2024-11-20 - Last updated in NVD database
Technical Details for CVE-2024-33019
Vulnerability Analysis
The vulnerability exists in Qualcomm WLAN firmware logic that parses TID-to-link mapping action frames. These frames are part of the IEEE 802.11be (Wi-Fi 7) multi-link operation feature and instruct a station on how to map traffic identifiers to specific radio links. The parser fails to properly validate length and offset fields inside the action frame body before reading mapped element data. When a malformed frame is received, the firmware reads memory outside the intended buffer boundary. The result is a transient denial of service in which the WLAN subsystem crashes or resets, dropping wireless connectivity for the duration of the recovery cycle.
Root Cause
The root cause is improper bounds checking during deserialization of variable-length fields in the TID-to-link mapping information element. The firmware trusts attacker-controlled length and count values when iterating over mapping entries. This produces an out-of-bounds read condition consistent with CWE-125 and a buffer over-read consistent with CWE-126. Because the read occurs in privileged WLAN firmware, the fault propagates up and terminates radio operation.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker within Wi-Fi range transmits a crafted 802.11 management action frame containing a malformed TID-to-link mapping element. Vulnerable devices that process the frame trigger the out-of-bounds read and lose WLAN service. The attack can be repeated continuously to sustain the outage. Because action frames can be sent to broadcast or to a specific BSSID, an attacker may target individual stations or every device associated with an access point.
// No verified public exploit code is available for CVE-2024-33019.
// The vulnerability is triggered by a malformed 802.11be TID-to-link
// mapping action frame transmitted within radio range of the target.
// Refer to the Qualcomm August 2024 Security Bulletin for details.
Detection Methods for CVE-2024-33019
Indicators of Compromise
- Unexpected WLAN subsystem crashes, kernel logs referencing wlan or cnss driver resets, or repeated wpa_supplicant disconnect events on Qualcomm-based devices.
- Sudden loss of Wi-Fi connectivity across multiple devices associated with the same access point during the presence of an unknown nearby transmitter.
- Captured 802.11 action frames with category indicating Protected EHT or multi-link operation and abnormally sized TID-to-link mapping elements.
Detection Strategies
- Deploy wireless intrusion detection sensors capable of decoding 802.11be action frames and alerting on malformed TID-to-link mapping information elements.
- Correlate endpoint and mobile device telemetry for WLAN driver crash signatures with concurrent timestamps to identify coordinated radio-frequency abuse.
- Track firmware build identifiers across the fleet to confirm which devices remain on pre-patch Qualcomm WLAN firmware levels.
Monitoring Recommendations
- Forward syslog, Android logcat, and MDM crash telemetry to a centralized analytics platform and alert on repeated WLAN firmware restarts.
- Monitor access point management consoles for elevated client disassociation rates that may indicate active exploitation.
- Periodically scan for rogue 802.11 transmitters in sensitive areas such as executive offices, vehicle fleets, and OT environments.
How to Mitigate CVE-2024-33019
Immediate Actions Required
- Apply the firmware updates referenced in the Qualcomm August 2024 Security Bulletin as soon as OEM builds are available.
- Coordinate with device OEMs and mobile carriers to confirm the security patch level that includes the fix is rolled out to all impacted handsets, vehicles, and networking gear.
- Inventory all Qualcomm-based assets using the affected chipset list and prioritize patching for devices on untrusted or shared wireless networks.
Patch Information
Qualcomm addressed the issue in the August 2024 security patch level. Fixes are delivered to downstream device manufacturers and integrated into vendor OTA updates, Android security patch level updates, and networking equipment firmware releases. Refer to the Qualcomm August 2024 Security Bulletin for the complete component list and patch identifiers.
Workarounds
- Where patching is delayed, restrict device use to trusted wireless networks and disable Wi-Fi when operating in untrusted radio environments.
- For enterprise WLAN deployments, enable Management Frame Protection (802.11w) on supported access points to limit unauthorized injection of management frames.
- Segment IoT, automotive, and operational technology devices that cannot be quickly patched onto isolated SSIDs with strict client isolation.
# Example: verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Example: monitor WLAN driver resets on Linux-based Qualcomm platforms
dmesg -w | grep -Ei 'wlan|cnss|wlfw|firmware crash'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
