CVE-2024-43047: Qualcomm FastRPC DSP Memory Corruption Zero-Day Exploited in Targeted Spyware Campaigns

On October 8, 2024, Qualcomm released a critical security bulletin detailing CVE-2024-43047, a high-severity use-after-free vulnerability affecting dozens of Qualcomm Snapdragon system-on-chip (SoC) platforms across hundreds of millions of Android smartphones. The vulnerability was jointly discovered and responsibly disclosed by Seth Jenkins of Google Project Zero and Conghui Wang of Amnesty International Security Lab. Google’s Threat Analysis Group (TAG) confirmed that threat actors have actively weaponized this zero-day in targeted, highly sophisticated spyware campaigns against civil society, journalists, and high-value intelligence targets.

Technical Root Cause Analysis: FastRPC HLOS Memory Mapping

The flaw resides in Qualcomm’s FastRPC (Fast Remote Procedure Call) architecture, which facilitates high-speed, low-latency inter-process communication between the High-Level Operating System (HLOS, such as Linux/Android kernel) and the Qualcomm Compute Digital Signal Processor (cDSP / aDSP).

When an unprivileged userspace application initiates remote execution on the DSP (via /dev/adsprpc-smd or /dev/fastrpc-*), the FastRPC kernel driver maps physical memory buffers allocated in HLOS space into the DSP’s internal MMU address space. A critical synchronization flaw exists during buffer unmapping:

/* Conceptual vulnerability analysis of FastRPC memory unmap routine */
static int fastrpc_mmap_remove(struct fastrpc_user *fl, struct fastrpc_mmap *map) {
    // Lock acquisition
    mutex_lock(&fl->map_mutex);
    
    // Free the driver internal memory mapping structure
    list_del(&map->node);
    fastrpc_mmap_free(map); // Memory freed here!
    
    // VULNERABILITY: Race condition window before DSP unmap notification completes.
    // If a concurrent thread invokes fastrpc_internal_munmap() using a cached handle,
    // the pointer 'map' is accessed after being freed (Use-After-Free).
    if (map->flags & FASTRPC_DMA_HANDLE) {
        dma_buf_put(map->buf); // Secondary free / invalid pointer dereference!
    }
    
    mutex_unlock(&fl->map_mutex);
    return 0;
}

Because the driver frees the internal bookkeeping structure fastrpc_mmap before verifying that the DSP coprocessor has completed tearing down its direct memory access (DMA) translation tables, an attacker can groom the kernel slab cache (specifically kmalloc-128 or kmalloc-256) to overwrite the freed structure. When the driver or DSP subsequent performs memory accesses, the attacker controls the pointer, leading to arbitrary kernel memory read/write primitives.

Exploitation Mechanics in Spyware Kill-Chains

Commercial surveillance vendors (such as NSO Group, Intellexa, and RCS Lab) routinely chain vulnerabilities to compromise mobile devices. In typical zero-click or one-click exploitation chains:

1. Initial Sandbox Execution: The attacker gains initial execution via a browser renderer exploit (Chrome/WebKit) or messaging parser (WhatsApp/iMessage).
2. DSP Device Interaction: Standard Android application sandboxes have read/write access to /dev/adsprpc-smd to enable camera and audio acceleration features.
3. Privilege Escalation via CVE-2024-43047: The exploit interacts with FastRPC, triggers the race condition during memory mapping/unmapping, achieves kernel use-after-free, disables SELinux, and elevates to root.
4. Payload Deployment: Once root is achieved, the implant installs persistent surveillance tools, dumps messaging databases, and taps microphone/GPS hardware.

Detection Telemetry & Threat Hunting

Remediation & Mitigation Protocol

1. OEM Firmware Updates: End users and enterprise administrators must apply the October 2024 (or later) Android security patch bulletin released by Google, Samsung, Xiaomi, and other device manufacturers immediately.
2. CISA Federal Compliance: Federal civilian agencies must remediate all vulnerable Qualcomm-powered mobile endpoints under BOD 22-01.
3. Device Quarantine for High-Risk Profiles: For high-risk personnel (diplomats, investigative reporters, legal counsel), deploy Lockdown Mode (on supported OSs) and restrict untrusted messaging links until firmware verification is confirmed.