CVE-2023-21638

7.8

HIGH CVSS 3.1

Incorrect Type Conversion or Cast in Video

Overview

Description

Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.

Details

INFO

Published Date :

July 4, 2023, 5:15 a.m.

Last Modified :

Nov. 21, 2024, 7:43 a.m.

Remotely Exploit :

No

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2023-21638 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Qualcomm	aqt1000_firmware
2	Qualcomm	qca6391_firmware
3	Qualcomm	qca6420_firmware
4	Qualcomm	qca6426_firmware
5	Qualcomm	qca6430_firmware
6	Qualcomm	qca6436_firmware
7	Qualcomm	qca6574au_firmware
8	Qualcomm	qca6696_firmware
9	Qualcomm	sa6145p_firmware
10	Qualcomm	sa6150p_firmware
11	Qualcomm	sa6155p_firmware
12	Qualcomm	sa8145p_firmware
13	Qualcomm	sa8150p_firmware
14	Qualcomm	sa8155p_firmware
15	Qualcomm	sa8195p_firmware
16	Qualcomm	sd855_firmware
17	Qualcomm	sd865_5g_firmware
18	Qualcomm	wcd9341_firmware
19	Qualcomm	wcd9380_firmware
20	Qualcomm	wsa8810_firmware
21	Qualcomm	wsa8815_firmware
22	Qualcomm	wsa8830_firmware
23	Qualcomm	wsa8835_firmware
24	Qualcomm	snapdragon_x55_5g_modem-rf_system_firmware
25	Qualcomm	snapdragon_xr2_5g_platform_firmware
26	Qualcomm	sxr2130_firmware
27	Qualcomm	fastconnect_6200_firmware
28	Qualcomm	fastconnect_6800_firmware
29	Qualcomm	fastconnect_6900_firmware
30	Qualcomm	fastconnect_7800_firmware
31	Qualcomm	snapdragon_855_mobile_platform_firmware
32	Qualcomm	snapdragon_8_gen_1_mobile_platform_firmware
33	Qualcomm	snapdragon_865_5g_mobile_platform_firmware
34	Qualcomm	snapdragon_855_firmware
35	Qualcomm	snapdragon_x55_5g_firmware
36	Qualcomm	snapdragon_8_gen_1_firmware
37	Qualcomm	snapdragon_865_5g_firmware
38	Qualcomm	snapdragon_865\+_5g_firmware
39	Qualcomm	snapdragon_870_5g_firmware
40	Qualcomm	snapdragon_xr2_5g_firmware
41	Qualcomm	snapdragon_855\+\/860_firmware
42	Qualcomm	aqt1000
43	Qualcomm	qca6391
44	Qualcomm	qca6420
45	Qualcomm	qca6426
46	Qualcomm	qca6430
47	Qualcomm	qca6436
48	Qualcomm	qca6574au
49	Qualcomm	qca6696
50	Qualcomm	sa6145p
51	Qualcomm	sa6150p
52	Qualcomm	sa6155p
53	Qualcomm	sa8150p
54	Qualcomm	sa8155p
55	Qualcomm	sa8195p
56	Qualcomm	sd855
57	Qualcomm	sd865_5g
58	Qualcomm	wcd9341
59	Qualcomm	wcd9380
60	Qualcomm	wsa8810
61	Qualcomm	wsa8815
62	Qualcomm	wsa8830
63	Qualcomm	wsa8835
64	Qualcomm	sxr2130
65	Qualcomm	fastconnect_6200
66	Qualcomm	fastconnect_6800
67	Qualcomm	fastconnect_6900
68	Qualcomm	sa8145p
69	Qualcomm	fastconnect_7800
70	Qualcomm	snapdragon_x55_5g
71	Qualcomm	snapdragon_xr2_5g
72	Qualcomm	snapdragon_8_gen_1
73	Qualcomm	snapdragon_855
74	Qualcomm	snapdragon_855\+\/860
75	Qualcomm	snapdragon_865_5g
76	Qualcomm	snapdragon_865\+_5g
77	Qualcomm	snapdragon_870_5g

: Total Affected Vendor : 1 | Products : 77

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	MEDIUM				[email protected]
	CVSS 3.1	HIGH				[email protected]

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-21638.

URL	Resource
https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin	Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-21638 is associated with the following CWEs:

CWE-704: Incorrect Type Conversion or Cast

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-21638 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-21638 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2023-21638 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

Nov. 21, 2024

Action	Type	Old Value	New Value
Added	Reference		https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin

CVE Modified by [email protected]

May. 14, 2024

Action	Type	Old Value	New Value

CVE Modified by [email protected]

Apr. 12, 2024

Action	Type	Old Value	New Value
Added	CWE		Qualcomm, Inc. CWE-704

Initial Analysis by [email protected]

Jul. 10, 2023

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Changed	Reference Type	https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin No Types Assigned	https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletin Vendor Advisory
Added	CWE		NIST CWE-704
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:aqt1000_firmware:-::::::: OR cpe:2.3:h:qualcomm:aqt1000:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-::::::: OR cpe:2.3:h:qualcomm:fastconnect_6200:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-::::::: OR cpe:2.3:h:qualcomm:fastconnect_6800:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-::::::: OR cpe:2.3:h:qualcomm:fastconnect_6900:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-::::::: OR cpe:2.3:h:qualcomm:fastconnect_7800:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6391_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6391:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6420_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6420:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6426_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6426:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6430_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6430:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6436_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6436:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6574au_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6574au:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:qca6696_firmware:-::::::: OR cpe:2.3:h:qualcomm:qca6696:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa6145p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa6145p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa6150p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa6150p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa6155p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa6155p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa8145p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa8145p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa8150p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa8150p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa8155p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa8155p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sa8195p_firmware:-::::::: OR cpe:2.3:h:qualcomm:sa8195p:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sd855_firmware:-::::::: OR cpe:2.3:h:qualcomm:sd855:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sd865_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:sd865_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_8_gen_1_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_8_gen_1:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_855_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_855:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_855\+\/860_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_855\+\/860:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_865_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_865_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_865\+_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_865\+_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_870_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_870_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_x55_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_x55_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:snapdragon_xr2_5g_firmware:-::::::: OR cpe:2.3:h:qualcomm:snapdragon_xr2_5g:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:sxr2130_firmware:-::::::: OR cpe:2.3:h:qualcomm:sxr2130:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wcd9341_firmware:-::::::: OR cpe:2.3:h:qualcomm:wcd9341:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wcd9380_firmware:-::::::: OR cpe:2.3:h:qualcomm:wcd9380:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wsa8810_firmware:-::::::: OR cpe:2.3:h:qualcomm:wsa8810:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wsa8815_firmware:-::::::: OR cpe:2.3:h:qualcomm:wsa8815:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wsa8830_firmware:-::::::: OR cpe:2.3:h:qualcomm:wsa8830:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:qualcomm:wsa8835_firmware:-::::::: OR cpe:2.3:h:qualcomm:wsa8835:-:::::::*

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

CVE-2023-21638

Incorrect Type Conversion or Cast in Video

Description

INFO

July 4, 2023, 5:15 a.m.

Nov. 21, 2024, 7:43 a.m.

No

[email protected]

Affected Products

CVSS Scores

References to Advisories, Solutions, and Tools

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

CVE Modified by [email protected]

CVE Modified by [email protected]

Initial Analysis by [email protected]

Vulnerability Scoring Details

Base CVSS Score: 7.8

Exploit Prediction

0.11 }} 0.07%

0.01501

Browse by Apps

CVE-2023-21638

Incorrect Type Conversion or Cast in Video

Description

INFO

July 4, 2023, 5:15 a.m.

Nov. 21, 2024, 7:43 a.m.

No

[email protected]

Affected Products

CVSS Scores

References to Advisories, Solutions, and Tools

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

CVE Modified by [email protected]

CVE Modified by [email protected]

Initial Analysis by [email protected]

Vulnerability Scoring Details

Base CVSS Score: 7.8

Exploit Prediction

0.11 }} 0.07%

0.01501

Cookie Preferences