CVE-2024-38397: Qualcomm Snapdragon DOS Vulnerability

CVE-2024-38397 Overview

CVE-2024-38397 is a transient denial-of-service vulnerability affecting Qualcomm WLAN firmware across a broad range of Snapdragon, FastConnect, QCA, and IPQ chipsets. The flaw exists in the parsing logic for IEEE 802.11 probe response and association response management frames. An attacker within wireless range can transmit a malformed frame that triggers an out-of-bounds read condition in the WLAN firmware, disrupting connectivity on the targeted device. The weakness is tracked under [CWE-125] (Out-of-bounds Read) and [CWE-126] (Buffer Over-read).

Critical Impact
A remote, unauthenticated attacker on the wireless medium can force a transient denial of service against any device using vulnerable Qualcomm WLAN firmware, including mobile platforms, automotive systems, and IoT gateways.

Affected Products

Qualcomm Snapdragon 8 Gen 2, 8+ Gen 2, and 8 Gen 3 Mobile Platforms
Qualcomm FastConnect 6700, 6900, and 7800 connectivity subsystems
Qualcomm QCA, IPQ, QCN, QCS, and automotive SA-series firmware

Discovery Timeline

2024-10-07 - CVE-2024-38397 published to NVD via the Qualcomm October 2024 Security Bulletin
2025-08-11 - Last updated in NVD database

Technical Details for CVE-2024-38397

Vulnerability Analysis

The vulnerability resides in the WLAN host or firmware code path that processes incoming 802.11 management frames, specifically probe response and association response frames. These frames carry variable-length information elements (IEs) such as supported rates, vendor-specific tags, and capability fields. When the parser encounters a crafted IE whose declared length exceeds the actual frame buffer, the firmware reads past the allocated boundary. This out-of-bounds read corrupts internal state and triggers a fault in the WLAN subsystem.

The impact is limited to availability. Successful exploitation does not yield code execution or information disclosure, but the WLAN stack enters an unusable state and requires re-initialization. On mobile devices this disconnects Wi-Fi; on infrastructure devices using IPQ or QCN chipsets, it can interrupt network services for connected clients.

Root Cause

The parser fails to validate IE length fields against the remaining frame buffer before dereferencing memory. This is a classic boundary check omission consistent with [CWE-126]. The condition is reachable during the normal scan and association workflow, which all Wi-Fi clients perform automatically.

Attack Vector

An attacker within radio range broadcasts a crafted probe response or association response frame. No authentication, user interaction, or prior network association is required. A rogue access point or injection-capable adapter is sufficient to deliver the malformed frame. The Qualcomm Security Bulletin for October 2024 documents the affected components and patch availability. See the Qualcomm Security Bulletin October 2024 for the official advisory.

Detection Methods for CVE-2024-38397

Indicators of Compromise

Unexpected WLAN subsystem crashes or firmware restart events in kernel logs (dmesg, logcat) referencing the Qualcomm WLAN driver
Repeated Wi-Fi disassociation events on devices in the presence of unknown access points
Probe response or association response frames containing malformed or oversized information elements observed in wireless captures

Detection Strategies

Capture wireless traffic with monitor-mode tools such as Wireshark and inspect IE length fields in management frames for inconsistencies against frame length
Correlate device-side WLAN driver fault logs with timestamps of nearby unauthorized SSIDs or rogue beacons
Deploy wireless intrusion detection sensors that flag anomalous management frame structures

Monitoring Recommendations

Forward mobile and endpoint kernel logs to a central log platform and alert on repeated WLAN firmware reset events
Monitor enterprise wireless infrastructure for unauthorized access points broadcasting in managed areas
Track patch deployment status for Qualcomm firmware updates across the affected device inventory

How to Mitigate CVE-2024-38397

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm October 2024 Security Bulletin to all affected devices
Inventory all endpoints, IoT, automotive, and network devices using affected Qualcomm chipsets and prioritize OEM patch delivery
For managed mobile fleets, enforce OS update policies that include the October 2024 Android Security Bulletin or vendor-equivalent release

Patch Information

Qualcomm released fixes for CVE-2024-38397 in the October 2024 Security Bulletin. OEMs integrate these into their device-specific firmware images. Refer to the Qualcomm Security Bulletin October 2024 for the complete list of patched components and version identifiers.

Workarounds

Disable Wi-Fi on affected devices when operating in untrusted radio environments until firmware updates are applied
Use wireless intrusion prevention systems to detect and contain rogue access points broadcasting malformed management frames
Restrict device usage to controlled wireless networks where rogue APs can be identified and removed

bash

# Verify Android security patch level on affected mobile devices
adb shell getprop ro.build.version.security_patch
# Expected output should be 2024-10-01 or later to include CVE-2024-38397 fixes