CVE-2024-45549: Qualcomm Sm8550p Information Disclosure

CVE-2024-45549 Overview

CVE-2024-45549 is an information disclosure vulnerability affecting a wide range of Qualcomm chipsets and firmware. The flaw occurs during the creation of Message Queue (MQ) channels, where sensitive data may be exposed to a local attacker. Qualcomm addressed the issue in its April 2025 security bulletin. The vulnerability is classified under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. Affected products span Snapdragon mobile, compute, automotive, XR, wearable, modem, connectivity, and audio platforms.

Critical Impact
A local attacker with low complexity access can trigger the flaw during MQ channel creation to disclose sensitive system data and impact integrity across hundreds of Qualcomm chipsets and firmware bundles.

Affected Products

Qualcomm Snapdragon mobile platforms (including Snapdragon 8 Gen 1/2/3, 8+ Gen 1/2, 865/865+/870 5G, 4 Gen 2, and 429)
Qualcomm compute, automotive, XR, and wearable platforms (Snapdragon 8cx Gen 3, Snapdragon AR1/AR2 Gen 1, Snapdragon XR2/XR2+ Gen 1, Snapdragon Wear 4100+, Snapdragon Auto 5G Modem-RF Gen 2)
Qualcomm modem, connectivity, and audio silicon (Snapdragon X35/X55/X62/X65/X70/X72/X75 5G Modem-RF, FastConnect 6700/6800/6900/7800, QCA/QCN/WCN/WCD/WSA series)

Discovery Timeline

2025-04-07 - CVE-2024-45549 published to NVD
April 2025 - Qualcomm releases patch via the Qualcomm April 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45549

Vulnerability Analysis

The vulnerability is an information disclosure weakness triggered during the creation of Message Queue (MQ) channels in Qualcomm firmware components. MQ channels are used for inter-process and inter-subsystem communication across Qualcomm SoC subsystems, including modem, DSP, connectivity, and audio blocks. During channel initialization, sensitive system information is exposed to an unauthorized control sphere, matching the [CWE-497] pattern. A local attacker able to invoke the affected interface can retrieve data that should remain restricted to a higher-privilege subsystem. The impact is not limited to confidentiality; the CVSS vector also reflects a high integrity impact, suggesting that leaked state can be leveraged to influence subsequent operations. Because the issue exists in low-level firmware shared across many product families, a single logic flaw propagates to hundreds of downstream chipsets.

Root Cause

The root cause is inadequate initialization or sanitization of memory and metadata during MQ channel creation. Buffers or descriptors used to establish the channel retain sensitive contents that are then observable through the channel's normal read paths. Qualcomm has not released public technical details beyond the April 2025 bulletin.

Attack Vector

Exploitation requires local access to a device running affected Qualcomm firmware. No authentication or user interaction is needed. An attacker with the ability to open or interact with the MQ channel interface, typically from a local process on the application processor, can trigger the disclosure by requesting channel creation and reading back leaked memory contents. See the Qualcomm April 2025 Security Bulletin for vendor-supplied component context.

Detection Methods for CVE-2024-45549

Indicators of Compromise

No public indicators of compromise have been published; the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and no proof-of-concept is publicly available.
Absence of the April 2025 (or later) Qualcomm firmware baseline on affected chipsets is the primary exposure indicator.

Detection Strategies

Inventory devices against the CPE list in the Qualcomm bulletin and flag any chipset or firmware bundle that has not received the April 2025 patch level.
Monitor for unauthorized local processes that repeatedly invoke MQ channel creation APIs or interact with modem, DSP, or connectivity IPC interfaces outside expected system daemons.
Correlate Android or platform vendor security patch levels (SPL) with the Qualcomm bulletin date to confirm downstream OEM uptake.

Monitoring Recommendations

Track OEM security patch level advisories (Android, ChromeOS, automotive stacks, IoT gateways) and confirm they reference the April 2025 Qualcomm bulletin.
Alert on unexpected process behavior that touches low-level IPC or shared memory subsystems on mobile, XR, or automotive endpoints.
Use EDR telemetry on managed mobile and compute endpoints to identify anomalous local privilege usage patterns preceding firmware-level data access.

How to Mitigate CVE-2024-45549

Immediate Actions Required

Apply the firmware update referenced in the Qualcomm April 2025 Security Bulletin as delivered by the device OEM or platform vendor.
Enforce a minimum Android security patch level of April 2025 on all managed mobile fleets and equivalent SPLs on compute, XR, automotive, and IoT devices.
Restrict installation of untrusted local applications on affected devices, since exploitation requires local access.

Patch Information

Qualcomm published fixes for the affected components in the April 2025 Security Bulletin. Device OEMs consume these fixes and ship them through their own firmware and OS updates. Administrators should verify remediation by confirming the device security patch level is April 2025 or later and by matching the installed firmware version against the specific component listed in the bulletin for their chipset.

Workarounds

No vendor-supplied workaround exists; firmware update is the only supported remediation path.
Reduce local attack surface by disallowing sideloaded applications, enforcing MDM policies, and using application allowlisting on managed endpoints until patched firmware is deployed.
For automotive, XR, and IoT deployments where firmware rollout is slower, isolate affected devices on segmented networks and limit physical access.

bash

# Verify Android security patch level on managed mobile endpoints
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-04-01 or later