Qualcomm Multi-Mode Call Processor Improper Validation of Array Index Vulnerability Allowing Memory Corruption

A critical vulnerability has been identified in the Qualcomm Multi-Mode Call Processor, specifically in the handling of the PLMN selection from the SOR failed list. This issue arises from improper validation of array indices, leading to memory corruption. The vulnerability is accessible remotely and affects several chipsets within the Qualcomm 5G IoT Modem, as well as various Snapdragon and QCA chipsets.

Impact

Exploitation of this vulnerability causes memory corruption, which can lead to arbitrary code execution or application crashes.

Remediation

Qualcomm has notified device manufacturers about this vulnerability and is actively sharing patches. For information on the patching status of released devices, contact the device manufacturer.