CVE-2024-33024: Qualcomm AR8035 Firmware DOS Vulnerability

CVE-2024-33024 Overview

CVE-2024-33024 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the Wi-Fi beacon frame parser, specifically when handling the Multi-Link Information Element (ML IE) introduced in Wi-Fi 7 (802.11be). A malformed beacon containing a length field inside the common info of the ML IE that exceeds the total ML IE length triggers an integer-related parsing fault. The issue is tracked under CWE-190 (Integer Overflow or Wraparound) and impacts FastConnect, Snapdragon, IPQ, QCA, QCN, and QCS series components used in smartphones, automotive platforms, networking gear, and IoT devices.

Critical Impact
An unauthenticated attacker within wireless range can transmit a crafted beacon to crash the Wi-Fi stack on vulnerable devices, disrupting connectivity across hundreds of Qualcomm-based products.

Affected Products

Qualcomm FastConnect 6700, 6800, 6900, and 7800 Wi-Fi subsystems
Snapdragon 8 Gen 2, 8 Gen 3, 8+ Gen 2, 865, 865+, 870, and XR2 5G mobile/XR platforms
Qualcomm IPQ, QCA, QCN, QCS, and SA-series networking and automotive firmware

Discovery Timeline

2024-08-05 - CVE-2024-33024 published to NVD
2024-08-05 - Qualcomm publishes the August 2024 Security Bulletin addressing the issue
2024-11-20 - Last updated in NVD database

Technical Details for CVE-2024-33024

Vulnerability Analysis

The vulnerability is exposed during parsing of 802.11 beacon frames that carry a Multi-Link Information Element. The ML IE is a structured container introduced for Wi-Fi 7 multi-link operation, which itself embeds a common info sub-field with its own length descriptor. The parser uses the inner common info length to advance through the buffer without verifying that the value remains within the outer ML IE length boundary. When an attacker supplies a common info length larger than the enclosing element, subsequent arithmetic on the offset wraps or computes a position outside the legitimate buffer. The Wi-Fi firmware then dereferences invalid memory and terminates the connection or restarts the wireless subsystem.

The impact is transient: the device recovers after the Wi-Fi stack resets, but service is interrupted for every malicious beacon received. Because beacons are broadcast and require no association, exploitation does not require authentication or user interaction.

Root Cause

The root cause is missing length validation between nested information element fields. The outer ML IE length is treated as authoritative for the container, but inner sub-element lengths are not bounded against it before being used in pointer arithmetic, leading to an integer overflow condition consistent with CWE-190.

Attack Vector

An adjacent or in-range attacker broadcasts a malformed 802.11be beacon containing a crafted ML IE. Any vulnerable client that scans, monitors, or processes the beacon parses the malformed element and crashes its Wi-Fi firmware. No prior association with the attacker's access point is required.

// Example exploitation code (sanitized)
// No verified public proof-of-concept is available for CVE-2024-33024.
// The vulnerability is triggered by transmitting an 802.11 beacon whose
// Multi-Link IE contains a `common info` length field greater than the
// total ML IE length, causing the firmware parser to read out of bounds.

Detection Methods for CVE-2024-33024

Indicators of Compromise

Repeated, unexplained Wi-Fi disconnects or driver restarts on Qualcomm-based devices in a specific physical location.
Kernel or HAL logs referencing ML IE parsing failures, beacon processing errors, or wlan subsystem crashes.
Presence of nearby 802.11be beacon frames advertising oversized or malformed Multi-Link Information Elements.

Detection Strategies

Capture wireless traffic with a monitor-mode adapter and inspect beacon frames for ML IE sub-element lengths that exceed the outer IE length.
Correlate device crash telemetry, mobile device management (MDM) connectivity events, and access point logs to identify clusters of Wi-Fi failures tied to a single broadcaster.
Use wireless intrusion detection systems (WIDS) to flag beacons from unknown BSSIDs that exhibit malformed 802.11be elements.

Monitoring Recommendations

Forward endpoint, mobile, and IoT crash logs to a centralized analytics platform so repeated Wi-Fi firmware resets become visible.
Monitor enterprise wireless infrastructure for rogue access points broadcasting 802.11be frames in environments where Wi-Fi 7 is not yet deployed.
Track Qualcomm security bulletin advisories and inventory firmware versions across mobile, automotive, and networking fleets.

How to Mitigate CVE-2024-33024

Immediate Actions Required

Apply vendor firmware updates that incorporate the Qualcomm August 2024 security bulletin patches as soon as OEMs publish them.
Inventory all Qualcomm chipsets in the environment, including phones, laptops, vehicles, access points, and IoT gateways, and prioritize unpatched devices.
Restrict use of vulnerable devices in untrusted RF environments until firmware is updated.

Patch Information

Qualcomm addressed CVE-2024-33024 in its August 2024 Security Bulletin. Device manufacturers must integrate the corrected firmware into their own software updates. Refer to the Qualcomm Security Bulletin August 2024 for the authoritative list of fixed components and downstream guidance.

Workarounds

Disable Wi-Fi on affected devices when operating in environments where unknown 802.11be beacons could be transmitted.
For enterprise wireless deployments, enable WIDS rules that detect and alert on malformed Multi-Link Information Elements.
Where feasible, prefer wired connectivity for critical Qualcomm-based systems until patched firmware is deployed.

bash

# Configuration example
# Temporarily disable the wireless interface on a Linux-based Qualcomm device
sudo ip link set wlan0 down

# Re-enable after firmware update has been applied
sudo ip link set wlan0 up