CVE-2024-43047

What is the Qualcomm DSP FastRPC Driver?

Qualcomm's Digital Signal Processor (DSP) is a dedicated processor integrated into Qualcomm Snapdragon SoCs that handles compute-intensive workloads like audio processing, image signal processing (ISP), and machine learning inference. The FastRPC (Fast Remote Procedure Call) driver enables communication between the application processor (running Linux/Android) and the DSP, managing memory mappings and inter-processor calls. The FastRPC driver runs as part of the Linux kernel and maintains memory maps of HLOS (High Level OS) memory for use by DSP processes — making it a privileged kernel component accessible from user-space applications that use Qualcomm DSP capabilities.

Overview

CVE-2024-43047 is a use-after-free vulnerability in the Qualcomm DSP Services FastRPC driver, triggered by memory corruption when maintaining memory maps of HLOS memory. A local, low-privileged attacker who can interact with DSP services can trigger the use-after-free, leading to kernel memory corruption and potentially privilege escalation to the kernel level. Qualcomm's October 2024 bulletin acknowledged "limited, targeted exploitation" — language confirmed to mean active zero-day use. CISA added it to the KEV catalog one day after the bulletin, reflecting the confirmed exploitation. Google's Threat Analysis Group (TAG) and Amnesty International's Security Lab both independently confirmed in-the-wild exploitation.

Affected Versions

Qualcomm identified the following chipsets as affected:

Check Qualcomm's October 2024 security bulletin for the complete affected chipset list. OEM-specific patches depend on Android device vendor update cadence.

Technical Details

CWE-416 (Use-After-Free). The FastRPC driver maintains memory maps linking HLOS memory regions to DSP-accessible memory. A flaw in the driver's memory management causes a reference to a freed memory region to be retained and later accessed — the classic use-after-free pattern. When the stale pointer is dereferenced, the attacker can read or write the freed memory region, which the kernel allocator may have repurposed for another object. Controlled UAF reads/writes in kernel memory provide the primitives needed to escalate from user space to kernel code execution.

On Android, kernel code execution bypasses the Android sandbox and provides complete control over the device, including access to all data, all running processes, and all hardware interfaces.

Discovery

Confirmed by Google's Threat Analysis Group (TAG) and Amnesty International Security Lab, who disclosed they had observed this vulnerability being exploited in targeted attacks. TAG and Amnesty International are the primary organizations tracking commercial spyware vendors (Pegasus, Predator, Graphite, etc.) and nation-state actors who deploy mobile exploit chains against journalists, activists, and government officials.

Exploitation Context

The confirmation by Google TAG and Amnesty International places this vulnerability in the context of commercial spyware or nation-state targeted attack campaigns — consistent with the "limited, targeted exploitation" characterization. Qualcomm SoCs power the majority of Android flagship and mid-range smartphones globally, making kernel vulnerabilities in Snapdragon DSP drivers a high-value target for mobile surveillance operators. The DSP attack surface is particularly attractive because it is less scrutinized by security researchers than the main application processor kernel path.

Remediation

1. Apply Android security updates from your device manufacturer that include Qualcomm's October 2024 security bulletin patches.
2. For Google Pixel devices: apply the October 2024 or later security patch level.
3. For Samsung Galaxy, OnePlus, Xiaomi, and other OEM devices: apply manufacturer security updates as they are released — update availability and timing vary by OEM and region.
4. Monitor OEM security bulletins for Qualcomm component fixes included in device updates.
5. High-risk individuals (journalists, activists, government officials, executives) should consider using devices with timely security update delivery (Google Pixel) and enabling additional protections where available.