CRITICAL🇵🇱 Wersja polska

CVE-2023-43556

CVSS 9.3v3.1pub. 2024-06-03upd. 2025-08-11

Memory corruption in Hypervisor when platform information mentioned is not aligned.

🤖 AI Analysis
How it works

The error classified as buffer overflow (CWE-120) consists of the Hypervisor component not properly verifying the alignment of data describing the hardware platform. When the provided data does not meet memory boundary requirements, a write occurs outside the intended buffer. This results in memory corruption in the privileged hypervisor layer that manages the isolation of virtual environments.

Impact

An attacker can cause memory corruption in the hypervisor context, which potentially enables violation of confidentiality, integrity, and availability of the entire system, including data isolated in separate virtual machines or TEE.

Mitigation & patch

Patches available from the manufacturer should be applied according to references – Qualcomm security bulletin from June 2024: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html

Who is affected

Devices equipped with Qualcomm AR8035, Qualcomm FastConnect 6700, and Qualcomm FastConnect 6900 chipsets – specific firmware versions are indicated in the Qualcomm security bulletin from June 2024.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Qualcomm Ar8035

    HW
    Qualcomm
    all versions

  • Qualcomm Ar8035 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6700

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6700 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6900

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6900 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 7800

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 7800 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Flight Rb5 5g

    HW
    Qualcomm
    all versions

  • Qualcomm Flight Rb5 5g Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qam8295p

    HW
    Qualcomm
    all versions

  • Qualcomm Qam8295p Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6391

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6391 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6574au

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6574au Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6595

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6595 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6696

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6696 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6698aq

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6698aq Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca8081

    HW
    Qualcomm
    all versions

  • Qualcomm Qca8081 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca8337

    HW
    Qualcomm
    all versions

  • Qualcomm Qca8337 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qcm4490

    HW
    Qualcomm
    all versions

  • Qualcomm Qcm4490 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qcm5430

    HW
    Qualcomm
    all versions

  • Qualcomm Qcm5430 Firmware

    OS
    Qualcomm
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-25289CRITICAL9.6PL ✓same product

Przepełnienie bufora stosu w NAN Service Discovery Frames — Qualcomm

CVE-2025-47372CRITICAL9.0PL ✓same product

Qualcomm: Memory Corruption przy ładowaniu uszkodzonego obrazu ELF

CVE-2025-27034CRITICAL9.8PL ✓same product

Qualcomm Firmware — memory corruption przy wyborze PLMN z listy SOR

CVE-2025-21483CRITICAL9.8PL ✓same product

Memory corruption w Qualcomm podczas składania pakietów RTP (NALUs)

CVE-2025-21450CRITICAL9.1PL ✓same product

Qualcomm: podatność kryptograficzna umożliwiająca Auth Bypass podczas pobierania