CVE-2024-49847: Qualcomm AR8035 Firmware DOS Vulnerability

CVE-2024-49847 Overview

CVE-2024-49847 is a transient denial-of-service vulnerability in multiple Qualcomm chipsets and firmware components. The flaw resides in the modem's processing of a registration acceptance Over-The-Air (OTA) message containing a malformed ciphering key data Information Element (IE). A network-positioned attacker can trigger an out-of-bounds read condition that causes the modem to crash or temporarily stop responding. The issue affects a wide range of Snapdragon mobile, automotive, wearable, and connectivity platforms, including the Snapdragon 8 Gen 3 and Snapdragon X75 5G Modem-RF. Qualcomm addressed the issue in the May 2025 security bulletin.

Critical Impact
Network-adjacent attackers can remotely cause a transient denial of service on cellular modem components across dozens of Qualcomm Snapdragon platforms without authentication or user interaction.

Affected Products

Qualcomm Snapdragon 8 Gen 3 Mobile Platform and SM8650Q / SM8750 / SM7675 firmware
Qualcomm Snapdragon X72 and X75 5G Modem-RF Systems
Qualcomm Snapdragon Auto 5G Modem-RF Gen 2, FastConnect 7800, and Snapdragon Wear 4100+

Discovery Timeline

2025-05-06 - CVE-2024-49847 published to NVD
2025-05-06 - Qualcomm releases security patch via May 2025 bulletin
2025-05-09 - Last updated in NVD database

Technical Details for CVE-2024-49847

Vulnerability Analysis

The vulnerability is classified under [CWE-126] Buffer Over-read and [CWE-125] Out-of-bounds Read. It occurs in the modem firmware path that parses a 3GPP registration acceptance OTA message. When the message includes a ciphering key data Information Element whose length or structure is inconsistent with the encoded payload, the parser reads beyond the bounds of the allocated buffer. This results in a transient denial of service that disrupts cellular connectivity until the modem recovers or the device is restarted.

Root Cause

The root cause is improper input validation in the IE parsing routine. The firmware trusts the declared length field of the ciphering key data IE without verifying that the embedded structure fits within the remaining message bytes. The subsequent read operation accesses memory outside the parsed message buffer, leading to a fault that the modem cannot handle gracefully.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker operating a rogue base station or man-in-the-middle radio relay can deliver a crafted registration acceptance message to vulnerable devices within radio range. Because cellular baseband processing happens before higher-layer authentication checks, victim devices process the malformed IE automatically. Successful exploitation knocks the modem offline, suspending calls, messaging, and mobile data on the affected device.

No public proof-of-concept exploit code is currently available. See the Qualcomm Security Bulletin May 2025 for vendor-supplied technical details.

Detection Methods for CVE-2024-49847

Indicators of Compromise

Repeated, unexplained loss of cellular service on multiple devices in the same geographic area
Modem subsystem crash logs or radio interface layer (RIL) resets in mobile device diagnostics
Unexpected base station identifiers appearing in cellular scan logs, suggesting rogue gNodeB or eNodeB activity

Detection Strategies

Aggregate modem crash telemetry from managed mobile fleets through enterprise mobility management (EMM) platforms
Monitor for clusters of cellular connectivity loss events that correlate by time and location
Use cellular survey tools to detect anomalous or unauthorized cell towers operating near sensitive facilities

Monitoring Recommendations

Centralize mobile device crash and connectivity logs in a SIEM or data lake for correlation analysis
Track Qualcomm firmware build versions across the device inventory to identify unpatched assets
Establish baselines for cellular availability so transient DoS events surface as anomalies

How to Mitigate CVE-2024-49847

Immediate Actions Required

Inventory all devices containing the affected Qualcomm chipsets, including mobile, automotive, IoT, and wearable assets
Apply OEM firmware updates that incorporate Qualcomm's May 2025 security bulletin fixes as they become available
Prioritize patching for devices operating in high-risk environments such as executive travel scenarios or facilities near uncontrolled airspace

Patch Information

Qualcomm published fixes for CVE-2024-49847 in the Qualcomm Security Bulletin May 2025. Device manufacturers must integrate the updated modem firmware into OEM software releases. End users receive the fix through carrier-distributed system updates. Verify the patch level on each device against the OEM advisory for the specific chipset.

Workarounds

Disable cellular radios on high-risk devices when not required, falling back to trusted Wi-Fi networks
Use cellular network policies that prefer 5G Standalone (SA) with mutual authentication where supported, reducing exposure to rogue legacy base stations
Restrict sensitive operations on devices that cannot yet receive the firmware update from the OEM

bash

# Verify Qualcomm modem firmware version on Android devices via ADB
adb shell getprop gsm.version.baseband
adb shell getprop ro.build.version.security_patch