{"id":"CVE-2023-33106","kind":"vulnerability","aliases":["CVE-2023-33106"],"related":[],"title":"Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND","description":"Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have a memory corruption bug in the Graphics driver when a large list of sync points is submitted through the KGSL IOCTL_KGSL_GPU_AUX_COMMAND call. Per the CISA KEV listing, it is exploited in the wild.","severity":"high","cvss":8.4,"epss":null,"exploited":true,"exploited_at":"2023-12-05T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8035 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6620 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6640 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6200 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6900 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm flight rb5 5g platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8255p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8295p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8650p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8775p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6174a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6426 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6436 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6595 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6595au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6696 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6698aq firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6797aq firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca8081 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca8337 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca9377 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm2290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4325 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm5430 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm6490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm8550 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn6024 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn9011 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn9012 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcn9024 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs2290 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor's security bulletin patch for the affected Qualcomm chipset; CISA says to apply vendor remediations or discontinue use if none exist.","status":"open","published_at":"2023-12-05T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:43+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:02:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's security bulletin patch for the affected Qualcomm chipset; CISA says to apply vendor remediations or discontinue use if none exist.","reach":"local","impact":"high","summary":"Multiple Qualcomm chipsets have a memory corruption bug in the Graphics driver when a large list of sync points is submitted through the KGSL IOCTL_KGSL_GPU_AUX_COMMAND call. Per the CISA KEV listing, it is exploited in the wild.","category":"infrastructure","who_cares":["android","qualcomm","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may corrupt kernel graphics memory, potentially gaining elevated privileges on the device","analyst_note":"Find the Qualcomm security bulletin for the affected chipset and patch level, and confirm the attack prerequisites and the exact affected device list at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2887,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':23A,26A '-33106':24A,27A '5g':63A '6200':42A '6700':46A '6800':50A '6900':54A '7800':58A 'action':248C 'android':159B 'appli':249C 'ar8035':32A 'aux':13A,20A,193B,237C,244C 'bug':173B 'call':195B 'chipset':168B,209C 'chipsets':30A 'cisa':198B,246C 'command':14A,21A,194B,238C,245C 'contain':210C 'corrupt':2A,172B,224C 'csra6620':35A 'csra6640':38A 'cve':22A,25A 'devic':164B 'discontinu':257C 'driver':177B 'due':221C 'exploit':160B,203B 'fastconnect':41A,45A,49A,53A,57A 'firmware':33A,36A,39A,43A,47A,51A,55A,59A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,104A,107A,110A,113A,116A,119A,122A,125A,128A,131A,134A,137A,140A,143A,146A,149A,152A,155A,158A 'flight':61A 'gpu':19A,192B,243C 'graphic':176B,226C 'infrastructur':161B 'instruct':255C 'ioctl':17A,190B,241C 'kev':199B 'kgsl':18A,189B,191B,242C 'larg':6A,180B,230C 'list':7A,181B,200B,231C 'memori':1A,171B,223C 'mitig':252C,265C 'mobil':163B 'mobile-devic':162B 'multipl':166B,207C 'multiple':29A 'offset':219C 'out-of-rang':214C 'per':196B,253C 'platform':64A 'point':10A,184B,234C 'pointer':218C 'product':261C 'qam8255p':67A 'qam8295p':70A 'qam8650p':73A 'qam8775p':76A 'qca6174a':79A 'qca6391':82A 'qca6426':85A 'qca6436':88A 'qca6574':91A 'qca6574a':94A 'qca6574au':97A 'qca6595':100A 'qca6595au':103A 'qca6696':106A 'qca6698aq':109A 'qca6797aq':112A 'qca8081':115A 'qca8337':118A 'qca9377':121A 'qcm2290':124A 'qcm4290':127A 'qcm4325':130A 'qcm4490':133A 'qcm5430':136A 'qcm6490':139A 'qcm8550':142A 'qcn6024':145A 'qcn9011':148A 'qcn9012':151A 'qcn9024':154A 'qcs2290':157A 'qualcomm':28A,31A,34A,37A,40A,44A,48A,52A,56A,60A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,102A,105A,108A,111A,114A,117A,120A,123A,126A,129A,132A,135A,138A,141A,144A,147A,150A,153A,156A,165B,167B,208C 'rang':217C 'rb5':62A 'remedi':250C,263C 'requir':247C 'submit':4A,186B,228C 'sync':9A,183B,233C 'unavail':267C 'use':212C,258C 'vendor':254C 'vulner':220C 'wild':206B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-05T00:00:00+00:00","kev":{"dateAdded":"2023-12-05","dueDate":"2023-12-26","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-33106","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33106","severity":null,"published_at":"2023-12-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-33106","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33106","severity":null,"published_at":"2023-12-05T03:15:14+00:00","modified_at":"2026-06-17T06:00:56+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}