CVE-2023-28543 : Security Advisory and Response

This CVE, assigned by Qualcomm, was published on September 5, 2023. It involves a vulnerability that can trigger Memory Corruption in the SNPE library due to an out-of-bounds read, specifically related to loading an untrusted model.

Understanding CVE-2023-28543

This section delves into the details of the CVE, outlining what it is and the impact it possesses.

What is CVE-2023-28543?

The vulnerability in CVE-2023-28543 revolves around a malformed DLC that can initiate Memory Corruption in the SNPE library. This can occur when loading an untrusted model, particularly if sourced from a remote location.

The Impact of CVE-2023-28543

The impact of this CVE is significant, with a high severity level across various aspects. The Confidentiality, Integrity, and Availability of the affected systems are all at risk, with no user interaction or special privileges required for exploitation.

Technical Details of CVE-2023-28543

This section provides a closer look at the vulnerability, its affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability arises from a malformed DLC triggering Memory Corruption in the SNPE library through an out-of-bounds read. The specific scenario involves loading untrusted models, especially those originating from external or remote sources.

Affected Systems and Versions

The Snapdragon platform by Qualcomm is affected by this vulnerability, impacting versions such as SD855, SD845, QCS605, and QCS405 in platforms like Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, and Snapdragon Voice & Music.

Exploitation Mechanism

The vulnerability is exploited by loading a malformed DLC that leads to Memory Corruption in the SNPE library through an out-of-bounds read. This can be triggered by loading untrusted models, introducing a potential threat to the affected systems.

Mitigation and Prevention

In response to CVE-2023-28543, it is crucial to take immediate action and implement long-term security practices to mitigate risks effectively.

Immediate Steps to Take

Ensure that only trusted models are loaded into the SNPE library to avoid triggering memory corruption.
Monitor and restrict the loading of models from external or untrusted sources to prevent exploitation of the vulnerability.
Stay informed about security bulletins and updates from Qualcomm regarding this specific issue.

Long-Term Security Practices

Regularly update and patch the affected systems and versions to protect against potential vulnerabilities.
Conduct regular security assessments and reviews to identify and address any potential weaknesses in system architecture.

Patching and Updates

Qualcomm has released information and guidance related to this vulnerability in their September 2023 security bulletin. It is recommended to follow their recommendations for patching and securing the affected systems against CVE-2023-28543.