Out-of-Range Pointer Offset Vulnerability (CVE‑2023‑33106) Affects Qualcomm Chipsets
What It Is – Qualcomm’s graphics driver on multiple chipsets contains a use‑of‑out‑of‑range pointer offset that can corrupt memory when a large list of sync points is submitted via the IOCTL_KGSL_GPU_AUX_COMMAND.
Exploitability – The flaw is publicly disclosed (CVE‑2023‑33106) and can be triggered locally; no public exploit code is known, but the vulnerability is rated CVSS 3.1 7.8 (High).
Affected Products – Qualcomm Snapdragon and other Qualcomm‑based SoCs that expose the KGSL GPU driver.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Continuous monitoring of firmware and driver updates is a core control that demonstrates due diligence and provides audit‑ready evidence of risk mitigation.
- Secure Configuration – Maintaining a hardened graphics stack and restricting privileged IOCTL calls aligns with the control objective of “secure configuration and change management.”
- Supply‑Chain Assurance – Demonstrating that you track and remediate chipset‑level flaws satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) through a single control evidence set.
Recommended Actions
- Verify which Qualcomm chipsets are present in your asset inventory.
- Subscribe to Qualcomm’s security advisory feed and apply any released firmware patches promptly.
- Incorporate the CVE into your vulnerability‑scanning baseline and track remediation status in your ticketing system.
- Document the remediation steps as part of your continuous control‑evidence repository.
Source: CISA KEV – CVE‑2023‑33106