Qualcomm disclosed active in-the-wild exploitation of CVE-2024-43047, a high-severity use-after-free vulnerability (CVSS 7.8) in its Digital Signal Processor (DSP) service. The vulnerability resides in the adsprpc (FastRPC) driver responsible for managing remote procedure calls between the High-Level Operating System (HLOS) and the DSP core. When processing memory-mapping requests via fastrpc_mmap ioctl calls, improper handling of user-controlled file descriptors in header buffers causes mapping collisions and memory corruption. An unprivileged local process can weaponize this flaw to break out of application sandboxes and achieve arbitrary code execution at kernel or DSP privilege levels.

Reported by Google Project Zero and Amnesty International, with active exploitation tracked by Google TAG, the zero-day was leveraged in targeted commercial spyware campaigns against civil society figures. The flaw affects 64 chipset families, including flagship Snapdragon 8 Gen 1, Snapdragon 888, FastConnect modules, and Snapdragon X55/X65 5G modems. Qualcomm released proprietary patches to original equipment manufacturers (OEMs), urging expedited downstream deployments across affected Android devices.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Use-after-free memory corruption in hardware-interfacing kernel drivers allows local untrusted code to bypass operating system security boundaries, escalating from restricted application contexts directly into privileged DSP coprocessor execution.
• Bullet 2 — Strategic & Defender Imperative: Mobile fleet administrators and enterprise defenders must treat SoC-level zero-days with critical urgency, auditing device inventories for vulnerable Qualcomm chipsets and prioritizing OEM firmware updates before exploit chains proliferate.