Qualcomm Audio Buffer Over-read Vulnerability Allowing Information Disclosure

A buffer over-read vulnerability has been identified in the audio component of certain Qualcomm chipsets. This vulnerability allows for information disclosure by invoking the callback function of the sound model driver from the Audio Digital Signal Processor (ADSP). The issue arises for every valid opcode received from the sound model driver, leading to the unintentional exposure of sensitive information.

Impact

Exploitation of this vulnerability can result in a buffer over-read, causing information disclosure.

Remediation

Qualcomm has released patches for this vulnerability. Instructions for applying the patch can be found in the Qualcomm January 2025 Security Bulletin.