{"id":"CVE-2023-33107","kind":"vulnerability","aliases":["CVE-2023-33107"],"related":[],"title":"Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call","description":"Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have an integer overflow in the Graphics Linux driver when assigning a shared virtual memory region during an IOCTL call, causing memory corruption. Listed by CISA as actively exploited, so an attacker with a way to reach the driver can likely corrupt kernel memory and gain control of the device.","severity":"high","cvss":8.4,"epss":null,"exploited":true,"exploited_at":"2023-12-05T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm 315 5g iot modem firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm apq8017 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm apq8064au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm aqt1000 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8031 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8035 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm c-v2x 9150 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6620 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6640 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csrb31024 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6200 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 6900 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm fastconnect 7800 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm flight rb5 5g platform firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm mdm9250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm mdm9650 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8108 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8209 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8608 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8909w firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8996au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8255p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8295p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8650p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qam8775p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6174a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6310 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6320 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6335 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6420 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6421 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6426 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6430 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6431 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6436 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6564 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6564a firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","embedded-linux","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["fully-patched-device","unaffected-chipset"],"how_to_check":"Check the device's Android or Linux security patch level against the Qualcomm bulletin for the affected chipset. unknown for a specific command.","fix":"Install the vendor firmware and OS update that includes the Qualcomm fix for CVE-2023-33107. unknown for the exact patched version.","status":"open","published_at":"2023-12-05T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:41+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:41Z","model":"claude-haiku-5-5","output":{"fix":"Install the vendor firmware and OS update that includes the Qualcomm fix for CVE-2023-33107. unknown for the exact patched version.","reach":"local","impact":"high","summary":"Multiple Qualcomm chipsets have an integer overflow in the Graphics Linux driver when assigning a shared virtual memory region during an IOCTL call, causing memory corruption. Listed by CISA as actively exploited, so an attacker with a way to reach the driver can likely corrupt kernel memory and gain control of the device.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices","embedded-linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker corrupts kernel memory on the device and may gain elevated privileges","analyst_note":"Sources give no affected chipset list, patched versions or exploit preconditions; check the Qualcomm security bulletin for the July 2023 release and the CISA KEV entry for the required action.","how_to_check":"Check the device's Android or Linux security patch level against the Qualcomm bulletin for the affected chipset. unknown for a specific command.","needs_analyst":true,"not_affected_if":["unaffected-chipset","fully-patched-device"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00052,"input_tokens":2849,"output_tokens":471,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':16A,19A '-33107':17A,20A '315':25A '5g':26A,83A '6200':62A '6700':66A '6800':70A '6900':74A '7800':78A '9150':49A 'action':247C 'activ':198B 'android':158B 'appli':248C 'apq8017':31A 'apq8064au':34A 'aqt1000':37A 'ar8031':40A 'ar8035':43A 'assign':7A,181B,237C 'attack':202B 'c':47A 'c-v2x':46A 'call':14A,190B,244C 'caus':191B 'chipset':170B,223C 'chipsets':23A 'cisa':196B,245C 'contain':224C 'control':217B 'corrupt':2A,193B,212B,232C 'csra6620':52A 'csra6640':55A 'csrb31024':58A 'cve':15A,18A 'devic':166B,220B 'discontinu':256C 'driver':179B,209B 'due':229C 'embed':160B 'embedded-linux':159B 'exploit':162B,199B 'fastconnect':61A,65A,69A,73A,77A 'firmware':29A,32A,35A,38A,41A,44A,50A,53A,56A,59A,63A,67A,71A,75A,79A,85A,88A,91A,94A,97A,100A,103A,106A,109A,112A,115A,118A,121A,124A,127A,130A,133A,136A,139A,142A,145A,148A,151A,154A,157A 'flight':81A 'gain':216B 'graphic':4A,177B,234C 'infrastructur':163B 'instruct':254C 'integ':173B,226C 'ioctl':13A,189B,243C 'iot':27A 'kernel':213B 'like':211B 'linux':5A,161B,178B,235C 'list':194B 'mdm9250':87A 'mdm9650':90A 'memori':1A,10A,185B,192B,214B,231C,240C 'mitig':251C,264C 'mobil':165B 'mobile-devic':164B 'modem':28A 'msm8108':93A 'msm8209':96A 'msm8608':99A 'msm8909w':102A 'msm8996au':105A 'multipl':168B,221C 'multiple':22A 'overflow':174B,227C 'per':252C 'platform':84A 'product':260C 'qam8255p':108A 'qam8295p':111A 'qam8650p':114A 'qam8775p':117A 'qca6174a':120A 'qca6310':123A 'qca6320':126A 'qca6335':129A 'qca6391':132A 'qca6420':135A 'qca6421':138A 'qca6426':141A 'qca6430':144A 'qca6431':147A 'qca6436':150A 'qca6564':153A 'qca6564a':156A 'qualcomm':21A,24A,30A,33A,36A,39A,42A,45A,51A,54A,57A,60A,64A,68A,72A,76A,80A,86A,89A,92A,95A,98A,101A,104A,107A,110A,113A,116A,119A,122A,125A,128A,131A,134A,137A,140A,143A,146A,149A,152A,155A,167B,169B,222C 'rb5':82A 'reach':207B 'region':11A,186B,241C 'remedi':249C,262C 'requir':246C 'share':8A,183B,238C 'unavail':266C 'use':257C 'v2x':48A 'vendor':253C 'virtual':9A,184B,239C 'vulner':228C 'way':205B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-05T00:00:00+00:00","kev":{"dateAdded":"2023-12-05","dueDate":"2023-12-26","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-33107","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33107","severity":null,"published_at":"2023-12-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-33107","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33107","severity":null,"published_at":"2023-12-05T03:15:14+00:00","modified_at":"2026-06-17T06:00:58+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}