CVE-2024-33064 Overview
CVE-2024-33064 is an information disclosure vulnerability in Qualcomm WLAN firmware affecting the parsing of Multiple BSSID (MBSSID) Information Elements (IEs) within 802.11 beacon frames. The flaw stems from improper bounds checking when processing nested MBSSID IE structures, allowing an attacker within wireless range to trigger an out-of-bounds read in firmware memory. Affected chipsets include the Qualcomm QCA6574AU, QCA6574A, QCA6564AU, QCA6564A, and MDM9628, which are deployed in automotive, industrial, and embedded connectivity products. Qualcomm addressed the issue in the October 2024 security bulletin.
Critical Impact
A network-adjacent attacker can broadcast crafted beacon frames to leak sensitive firmware memory contents from vulnerable Qualcomm WLAN-enabled devices without user interaction or authentication.
Affected Products
- Qualcomm QCA6574AU / QCA6574A WLAN firmware
- Qualcomm QCA6564AU / QCA6564A WLAN firmware
- Qualcomm MDM9628 firmware
Discovery Timeline
- 2024-10-07 - CVE-2024-33064 published to NVD alongside the Qualcomm October 2024 security bulletin
- 2024-10-16 - Last updated in NVD database
Technical Details for CVE-2024-33064
Vulnerability Analysis
The vulnerability resides in the WLAN firmware routine responsible for parsing Multiple BSSID Information Elements carried in 802.11 beacon frames. MBSSID IEs allow a single physical access point to advertise multiple virtual BSSIDs through nested sub-element structures. When multiple MBSSID IEs are chained within a beacon, the parser fails to validate the cumulative length of nested sub-elements against the actual frame buffer boundary.
The issue is categorized under [CWE-125] (Out-of-bounds Read) and [CWE-126] (Buffer Over-read). Successful exploitation leaks adjacent firmware memory, which may contain cryptographic material, session state, or other sensitive runtime data. The bug also produces a limited availability impact, consistent with firmware-level parsing faults that can disrupt the WLAN subsystem.
Root Cause
The parser assumes well-formed length fields in MBSSID IEs and iterates through sub-elements without revalidating remaining buffer space after each nested element. When an attacker constructs a beacon with overlapping or oversized MBSSID length descriptors, the read pointer advances past the legitimate frame boundary into adjacent memory.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker within wireless transmission range broadcasts malformed 802.11 beacon frames containing crafted MBSSID IE chains. Vulnerable devices passively scanning or associated to nearby networks process these beacons through the affected parser, triggering the out-of-bounds read. Because beacons are accepted before any association handshake, the attack surface is exposed any time the WLAN radio is active.
No public proof-of-concept code or exploit has been observed in the wild. See the Qualcomm October 2024 Security Bulletin for vendor technical details.
Detection Methods for CVE-2024-33064
Indicators of Compromise
- Unexpected WLAN firmware crashes, restarts, or driver resets on devices using affected Qualcomm chipsets
- Repeated beacon frames from unknown BSSIDs with anomalous or malformed MBSSID IE structures captured during 802.11 monitoring
- Sudden bursts of de-authentication or disassociation events correlated with the presence of unknown nearby SSIDs
Detection Strategies
- Deploy wireless intrusion detection (WIDS) sensors to inspect beacon frames for malformed MBSSID IE length fields and nested element overflows
- Monitor host telemetry for WLAN driver and firmware fault events that may indicate parser-level memory corruption
- Correlate physical-location signal data with anomalous beacon sources to identify rogue transmitters operating near sensitive assets
Monitoring Recommendations
- Enable verbose WLAN firmware logging on affected devices and forward events to a centralized log platform for review
- Track vendor firmware version inventory across automotive, IoT, and embedded fleets to identify unpatched Qualcomm WLAN modules
- Alert on repeated beacon-driven WLAN subsystem restarts within short time windows
How to Mitigate CVE-2024-33064
Immediate Actions Required
- Inventory all devices containing affected Qualcomm chipsets (QCA6574AU, QCA6574A, QCA6564AU, QCA6564A, MDM9628) and confirm firmware version
- Apply the firmware updates referenced in the Qualcomm October 2024 security bulletin as soon as OEM-distributed images become available
- Disable WLAN radios on affected devices in high-risk environments until patches are deployed
Patch Information
Qualcomm published the fix in the Qualcomm October 2024 Security Bulletin. Because Qualcomm distributes firmware to OEMs rather than end users directly, patch availability depends on the device manufacturer integrating the updated WLAN firmware into their next platform release.
Workarounds
- Restrict WLAN operation to controlled RF environments where rogue beacon transmitters are unlikely to operate
- Reduce passive scanning intervals where the WLAN stack supports configuration, limiting exposure to malicious beacons
- Segment affected IoT and automotive endpoints onto isolated networks to limit downstream impact from any leaked data
# Verify Qualcomm WLAN firmware version on a Linux-based device
ethtool -i wlan0 | grep -E 'driver|firmware-version'
dmesg | grep -iE 'qca|wlan|mbssid'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
