Security readout for executives and security teams
Plain-English summary
CVE-2023-21640 is a Qualcomm Snapdragon-related Linux memory corruption issue. A privileged local caller can trigger it through a file upload API using oversized parameters. The impact can be serious on affected devices, but the published CVSS vector requires high privileges and there is no supplied evidence of active exploitation.
Executive priority
Treat as a moderate-priority firmware and device exposure issue. It is not described as remotely exploitable or actively exploited, but affected devices could face high-impact compromise if an attacker already has privileged local access. Prioritize confirmation and vendor updates for critical mobile, wireless, or embedded assets.
Technical view
The issue is classified as CWE-120, buffer copy without checking input size. Qualcomm lists memory corruption in Linux when the file upload API receives large-buffer parameters. CVSS 3.1 is 6.7: local attack, low complexity, high privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure appears limited to listed Qualcomm products: FastConnect 6900, FastConnect 7800, Snapdragon 8 Gen 1 Mobile Platform, WCD9380, WSA8830, and WSA8835. Organizations typically inherit risk through OEM devices or embedded systems using those components. The bundle states other products are unaffected by default.
Exploitation context
The source bundle does not show KEV listing or active exploitation. The CVSS vector indicates exploitation requires local access and high privileges, reducing broad remote risk. The business concern is post-compromise impact: a privileged local actor could potentially affect confidentiality, integrity, and availability on affected Linux-based devices.
Researcher notes
Evidence is limited to the CVE data and Qualcomm bulletin reference. The bundle does not provide fixed versions, proof-of-concept status, exact vulnerable code path, or OEM build mapping. Avoid assuming exploitability beyond the local, high-privilege CVSS vector and the listed affected Qualcomm products.
Mitigation direction
- Check Qualcomm’s July 2023 security bulletin for vendor guidance and fixed package details.
- Apply OEM firmware or security updates for affected devices when available.
- Prioritize assets using the listed Snapdragon, FastConnect, WCD9380, or WSA883x components.
- Limit privileged local access on affected Linux-based devices.
- Track OEM advisories because downstream patch timing may vary by device vendor.
Validation and detection
- Inventory devices and embedded platforms for the affected Qualcomm components.
- Confirm whether each device runs affected Linux software from the relevant OEM.
- Compare device firmware and security patch levels against Qualcomm and OEM guidance.
- Document systems where patch availability is unknown or vendor evidence is incomplete.
- Monitor for vendor-specific advisories that map this CVE to product builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-21640 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H0.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.qualcomm.com/company/product-security/bulletins/july-2023-bulletinCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.