CVE-2024-43047: Qualcomm Multiple Chipsets Use-After-Free Vulnerability

CVE-2024-43047 is a use-after-free vulnerability affecting multiple Qualcomm chipsets. It stems from memory corruption in DSP Services while those services maintain memory maps of HLOS memory. For IT and security teams managing fleets of mobile devices, embedded systems, or other hardware that rely on Qualcomm silicon, this class of flaw can allow an attacker who can reach the vulnerable component to corrupt memory and potentially gain elevated control. Confirm exact impact and affected products against the vendor advisory, as public detail is limited to the CWE-416 description and CISA summary.

Because the issue sits in low-level DSP services that interact with host OS memory maps, successful abuse could undermine isolation between the digital signal processor and the high-level operating system. That makes timely inventory and remediation important for any environment that deploys Qualcomm-based hardware.

How it works

The vulnerability is classified as CWE-416, a use-after-free condition. In this case the free occurs inside DSP Services while the component is maintaining memory maps of HLOS memory. After a memory region is released, a subsequent operation still references the stale pointer, producing memory corruption. An attacker who can trigger the relevant DSP service path may be able to influence the freed object’s contents or reuse the memory for controlled data. The precise trigger conditions and required privileges are not detailed in the public summary; defenders must treat any reachable DSP memory-mapping interface as potentially exploitable until the vendor advisory is reviewed.

In practice this class of flaw is typically reached from local or privileged contexts on the device, though remote vectors cannot be ruled out without the full advisory. Exploitation would aim to convert the memory corruption into code execution or privilege escalation inside the DSP or adjacent HLOS components.

Am I affected? How to find it in your systems

Qualcomm chipsets appear in smartphones, tablets, IoT gateways, automotive modules, and many embedded platforms. Inventory starts with asset management systems that record SoC or modem identifiers. Query device management platforms (MDM, EMM, or configuration management databases) for Qualcomm chipset model strings and firmware versions. On Android fleets, collect build fingerprints and baseband versions; on other platforms, extract the DSP firmware revision via vendor diagnostic tools or sysfs-style interfaces where available.

Compare collected identifiers against the list of affected chipsets published by Qualcomm. Because the advisory may list specific chipset families rather than a simple version range, treat any unconfirmed Qualcomm DSP-enabled device as potentially in scope until verified. Look for anomalous DSP-related crashes, unexpected memory-map operations, or kernel logs referencing DSP service faults; these can serve as weak indicators of attempted exploitation, though they are not definitive. Confirm all detection guidance against the vendor advisory.

How to remediate

Apply the remediations or mitigations supplied by Qualcomm for the affected chipsets. The CISA-required action is to follow vendor instructions or discontinue use of the product if no remediation is available. Obtain the official firmware or software update package that addresses CVE-2024-43047 and deploy it through your normal device-update pipeline. After installation, verify the new DSP firmware version is present on a sample of devices.

Beyond the patch, harden the surrounding environment: restrict untrusted code from invoking DSP services, enforce least-privilege access to memory-mapping interfaces, and keep the HLOS fully updated so that any residual corruption is harder to convert into system compromise. Re-inventory after patching to confirm coverage.

If you can't patch immediately

Segment devices that contain unpatched Qualcomm chipsets onto restricted network zones with limited outbound connectivity. Where a host-based or network virtual-patching capability exists, apply signatures or rules that block anomalous DSP service calls if such rules are available from the vendor or security vendors. Disable non-essential DSP features or memory-mapping interfaces if the platform configuration allows it without breaking core functionality. Increase monitoring of DSP crash dumps, memory-allocation anomalies, and privilege-escalation attempts on those devices. These compensating controls reduce exposure but do not eliminate the underlying use-after-free; schedule the official update as soon as operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to device compromise and subsequent data exposure. Known ransomware use of CVE-2024-43047 is not documented. If you suspect devices were targeted, isolate them, preserve forensic images, and review access logs for lateral movement. Readers can run a free exposure scan of their email addresses against known breach data sets to determine whether credentials or personal information have already appeared in public dumps.