CVE-2024-33048: Qualcomm Ar8035 Firmware DOS Vulnerability

CVE-2024-33048 Overview

CVE-2024-33048 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm WLAN and connectivity firmware components. The flaw exists in the parsing logic for the Traffic Identifier (TID)-to-link mapping element contained in 802.11 beacon and probe response frames. An attacker within wireless range can transmit a crafted frame that triggers an out-of-bounds read condition during element parsing, causing the affected component to enter a transient DoS state. The vulnerability is tracked under [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read). Qualcomm published remediation details in the Qualcomm Security Bulletin - September 2024.

Critical Impact
A remote, unauthenticated attacker within Wi-Fi range can disrupt wireless connectivity on hundreds of Qualcomm-powered devices including Snapdragon mobile platforms, FastConnect Wi-Fi modules, IPQ access point SoCs, and automotive/IoT chipsets.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 8 Gen 2/Gen 3, 8+ Gen 2, 865/865+/870 5G, 835, 429)
Qualcomm FastConnect 6700/6800/6900/7800 Wi-Fi/Bluetooth subsystems
Qualcomm IPQ networking SoCs (IPQ5010–IPQ9574 series) and QCN/QCA Wi-Fi chipsets

Discovery Timeline

2024-09-02 - CVE-2024-33048 published to NVD
September 2024 - Qualcomm publishes security bulletin with patch information
2025-08-11 - Last updated in NVD database

Technical Details for CVE-2024-33048

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition that occurs while the WLAN firmware processes the TID-to-link mapping information element (IE) inside an incoming beacon or probe response frame. TID-to-link mapping is an 802.11be (Wi-Fi 7) Multi-Link Operation (MLO) feature that maps traffic identifiers to specific radio links. When the parser reads element fields without correctly validating the declared element length against the remaining frame buffer, it accesses memory beyond the intended boundary. The result is a transient DoS impacting availability of the wireless stack, requiring a reset or reconnection to restore service.

Root Cause

The root cause is missing or insufficient length validation in the TID-to-link mapping IE parser. The firmware trusts attacker-controlled length and count fields embedded in the management frame and dereferences memory based on those values. This corresponds to [CWE-126] (Buffer Over-read) and [CWE-125] (Out-of-Bounds Read), where the read offset exceeds the allocated frame buffer.

Attack Vector

Exploitation requires network adjacency over Wi-Fi but no authentication and no user interaction. An attacker operating a rogue access point or injecting frames over the air can broadcast a beacon or respond to a probe request with a malformed TID-to-link mapping element. Any vulnerable Qualcomm-based station that parses the frame during scanning or association triggers the out-of-bounds read, leading to interruption of the WLAN subsystem.

// No verified public proof-of-concept code is available for CVE-2024-33048.
// Refer to the Qualcomm September 2024 security bulletin for technical details.

Detection Methods for CVE-2024-33048

Indicators of Compromise

Repeated WLAN firmware crashes, subsystem restarts, or wlan driver reset events in kernel/dmesg logs on Qualcomm-based endpoints
Unexpected disconnections from Wi-Fi networks coinciding with the presence of unknown SSIDs or rogue access points broadcasting Wi-Fi 7 / MLO capability elements
Beacon or probe response frames containing malformed TID-to-link mapping (Element ID 109) information elements observed in over-the-air captures

Detection Strategies

Capture 802.11 management frames in monitor mode and inspect TID-to-link mapping IEs for inconsistent length fields or oversized control bitmaps
Correlate device-side WLAN firmware crash telemetry with the presence of nearby unmanaged or unauthenticated access points
Deploy wireless intrusion detection sensors (WIDS) capable of flagging anomalous IEs in beacon/probe response traffic

Monitoring Recommendations

Forward mobile device management (MDM) and endpoint logs related to WLAN driver resets to a centralized SIEM for trend analysis
Monitor for clusters of Wi-Fi disconnect events across multiple devices in the same physical location, which may indicate active over-the-air exploitation
Track firmware patch level inventory across Snapdragon, FastConnect, and IPQ-based assets to identify exposed devices

How to Mitigate CVE-2024-33048

Immediate Actions Required

Apply the Qualcomm September 2024 security bulletin patches through your OEM (mobile, automotive, networking equipment vendors) as soon as builds are made available
Inventory all Qualcomm WLAN-equipped assets using the affected chipset list and prioritize devices that operate in untrusted RF environments
Restrict use of vulnerable devices in high-risk wireless environments such as conferences, public venues, and shared office spaces until patched

Patch Information

Qualcomm released fixes as part of its September 2024 Security Bulletin. Patches must be integrated and delivered by downstream OEMs and ODMs through firmware or full operating system updates. Customers should consult their device vendor for the corresponding patch build that incorporates the Qualcomm fix.

Workarounds

Disable Wi-Fi on affected devices when operating in untrusted RF environments where patches have not yet been applied
Where possible, disable 802.11be (Wi-Fi 7) Multi-Link Operation features in client and access point configurations until firmware updates are deployed
Use enterprise WIDS/WIPS to detect and contain rogue access points broadcasting malformed management frames near critical assets

bash

# Example: temporarily disable Wi-Fi on a Linux endpoint pending firmware update
sudo nmcli radio wifi off

# Verify radio state
nmcli radio