CVE-2024-33073: Qualcomm Wsa8845h Information Disclosure

CVE-2024-33073 Overview

CVE-2024-33073 is an information disclosure vulnerability in Qualcomm WLAN firmware that affects the parsing of the Multi-Link (ML) Information Element (IE). The flaw resides in how the firmware processes the BSS parameter change count and MLD capabilities fields contained within the ML IE used by Wi-Fi 7 (802.11be) Multi-Link Operation. The weakness is tracked under CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read). A remote attacker on the wireless network can trigger an out-of-bounds read, exposing adjacent memory contents from the WLAN firmware. The vulnerability impacts a broad set of Qualcomm Snapdragon mobile, automotive, networking, and IoT platforms.

Critical Impact
A remote, unauthenticated attacker can leak sensitive WLAN firmware memory through malformed 802.11be Multi-Link IE frames, with potential secondary availability impact.

Affected Products

Qualcomm FastConnect 6700, 6900, and 7800 Wi-Fi chipsets
Qualcomm Snapdragon 8 Gen 2, 8+ Gen 2, and 8 Gen 3 Mobile Platforms
Qualcomm IPQ networking platforms, QCN access point chipsets, and QCA Wi-Fi modules

Discovery Timeline

2024-10-07 - CVE-2024-33073 published to NVD
2025-08-11 - Last updated in NVD database

Technical Details for CVE-2024-33073

Vulnerability Analysis

The defect exists in the Qualcomm WLAN firmware routines that parse the Multi-Link Information Element introduced by IEEE 802.11be. The ML IE carries variable-length subfields, including the BSS parameter change count and the MLD capabilities. The firmware reads these fields without sufficient bounds validation against the declared element length. When an attacker constructs a frame whose ML IE specifies an inconsistent or truncated length, the parser reads past the end of the legitimate buffer.

The out-of-bounds read returns adjacent firmware memory to the caller or into subsequent processing routines. This results in confidentiality loss for data residing in WLAN subsystem memory, which may include cryptographic material, session state, or buffered frames. The CVSS metrics also indicate a low availability impact, consistent with the possibility of triggering parser faults that disrupt Wi-Fi service.

Root Cause

The root cause is missing length validation in the ML IE parser. The firmware trusts attacker-controlled length indicators when locating the BSS parameter change count and MLD capabilities subfields. Without verifying that the requested offsets remain within the IE boundary, the parser dereferences memory outside the intended buffer, producing the [CWE-125] out-of-bounds read and [CWE-126] buffer over-read conditions.

Attack Vector

Exploitation requires the attacker to transmit a crafted 802.11 management frame containing a malformed Multi-Link IE to a vulnerable device, or to lure the target into associating with a rogue access point that emits such frames. No user interaction or authentication is required, and the attack can be launched from any station within radio range or through an upstream wireless path. Successful parsing of the malicious IE triggers the over-read inside the WLAN firmware. The vulnerability is described in the Qualcomm Security Bulletin October 2024.

Detection Methods for CVE-2024-33073

Indicators of Compromise

Unexpected WLAN firmware crashes, watchdog resets, or cnss subsystem restarts on Snapdragon-based devices coinciding with nearby Wi-Fi activity.
Beacon, probe response, or association response frames containing ML IE (element ID 255, extension ID 107) with inconsistent length fields or malformed BSS parameter change count and MLD capabilities subfields.
Persistent presence of unknown 802.11be-capable access points advertising malformed Multi-Link elements in environments where Wi-Fi 7 is not deployed.

Detection Strategies

Deploy wireless intrusion detection (WIDS) signatures that validate ML IE length consistency and flag frames whose declared subfield lengths exceed the element boundary.
Correlate kernel and HAL logs (dmesg, wlan driver logs, vendor-specific crash dumps) for repeated WLAN firmware exceptions tied to ML IE processing.
Capture over-the-air traffic with monitor-mode sniffers and inspect 802.11be management frames for anomalous Multi-Link element structures.

Monitoring Recommendations

Centralize device telemetry, including WLAN subsystem crash reports and reboot causes, to identify clusters of failures indicative of remote exploitation attempts.
Track firmware build versions across the fleet so patched and unpatched Qualcomm components can be distinguished during incident triage.
Monitor enterprise wireless infrastructure for unauthorized 802.11be SSIDs and rogue APs that could deliver malicious ML IE frames.

How to Mitigate CVE-2024-33073

Immediate Actions Required

Apply vendor firmware updates from device OEMs that incorporate the Qualcomm October 2024 security bulletin fixes for the affected WLAN, modem, and platform firmware.
Inventory devices using FastConnect, Snapdragon mobile, automotive, IPQ, QCN, and QCA components against the affected products list, and prioritize patching for internet-facing or high-value endpoints.
Restrict use of untrusted Wi-Fi networks on vulnerable devices until OEM firmware updates are deployed.

Patch Information

Qualcomm published patches in the Qualcomm Security Bulletin October 2024. Remediation is delivered through downstream OEM firmware images for phones, automotive head units, access points, and IoT gateways. Verify the WLAN firmware build distributed by the device manufacturer includes the October 2024 Qualcomm component updates.

Workarounds

Disable Wi-Fi on affected devices in environments where untrusted wireless transmitters may be present until patches are applied.
Where supported, disable 802.11be Multi-Link Operation in driver or access point configuration to reduce the attack surface for malformed ML IE processing.
Enforce connectivity only to managed, trusted SSIDs through MDM policy to limit exposure to rogue access points emitting crafted Multi-Link frames.

bash

# Example: disable Wi-Fi on a managed Android device via ADB until firmware is patched
adb shell svc wifi disable

# Example: identify Qualcomm WLAN firmware build on a Linux-based device
dmesg | grep -i "wlan\|cnss\|qca\|qcn"
cat /sys/module/wlan/parameters/* 2>/dev/null