How do you patch or mitigate CVE-2024-43047 (Qualcomm Multiple Chipsets Use-After-Free)?

CISA’s required action for CVE-2024-43047 is to apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. In practice, find every instance of Qualcomm Multiple Chipsets in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What patching means for a Qualcomm chipset use-after-free

The practical job here is exposure control, not root-cause analysis. A use-after-free in chipset firmware or driver code is only actionable once you know which devices, OS builds, vendor packages, or OEM integrations carry the vulnerable Qualcomm components. That is why the first step is inventory, then the vendor update or mitigation path, then verification that the vulnerable component is no longer reachable in production.

In a mixed estate, this is rarely one uniform patch wave. The same chipset issue may sit behind different device brands, carrier builds, or firmware update channels, so the remediation plan has to follow the vendor’s instructions for each platform rather than assuming a single operating-system patch will cover everything.

For tracking and prioritisation, align the work to the public vulnerability record and the remediation status in the CVE Program and the CISA Known Exploited Vulnerabilities Catalog. If the issue is in your fleet, treat the vendor security advisory as the source of truth for exactly what can be updated and what mitigation is acceptable.

How to reduce exposure when the fix is not immediate

If remediation is delayed, reduce the attack surface around the affected devices rather than leaving them in a normal trust posture. For connected mobile or embedded endpoints, that usually means restricting network reachability, removing direct internet exposure, and tightening which management planes, services, or users can reach the vulnerable device.

Where the vulnerable component is embedded in a product you cannot quickly replace, a compensating control is only useful if it materially limits exploitation conditions. Segmentation, access reduction, and service disablement can buy time, but they do not equal a fix, and they should be tracked as temporary exceptions with an expiry date.

If you need a broader playbook for remediation hygiene, use the Vulnerability Management Guide to anchor the work in asset scope, exception handling, and verification. For mobile or endpoint-heavy estates, the Mobile Device Security Guide is the most relevant NHIMG starting point for containment controls, enrolment, and device policy enforcement.

What to check after remediation

Do not stop at “the patch was deployed.” Confirm that every affected instance actually received the vendor update or mitigation, and that the device no longer presents the vulnerable service or code path. In practice, that means validating inventory, firmware or package version evidence, and any change record that proves the remediation took effect across all device classes.

If the product was left in service during the window between disclosure and remediation, look for signs that it may already have been targeted. A use-after-free can be attractive because memory corruption bugs may be leveraged for code execution or denial of service, so post-fix review should include logs, crash artefacts, unusual reboots, and any unexplained configuration changes on the affected endpoints.

The best evidence is operational, not theoretical: show which assets were exposed, which ones were updated or isolated, and which ones were retired because no safe remediation path existed. That closes the loop between vulnerability discovery and actual risk reduction.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE remediation and exposure reduction are core vulnerability management duties.
Recommendation — Prioritise, patch, or isolate exposed assets and track remediation to closure.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about applying vendor remediation or mitigating an exploitable flaw.
	RA-5 — Vulnerability Monitoring and Scanning	Finding every affected Qualcomm instance requires ongoing asset and vulnerability discovery.
Recommendation — Implement and verify vendor remediation for the vulnerable component. Scan and inventory assets to confirm where the vulnerable chipset is present.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	The answer requires identifying, treating, and verifying a known technical vulnerability.
Recommendation — Track the vulnerability, apply the vendor fix, and document any temporary exceptions.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The subject is operational vulnerability treatment and exception handling.
Recommendation — Maintain a vulnerability workflow that remediates or mitigates exposed devices.

Practitioner Guidance

What to prioritise: Start with externally reachable devices and anything that cannot be quickly replaced or patched. Those assets carry the greatest consequence if the bug is reachable before remediation.

Decision rule: If the vendor provides a fix, apply it and verify the deployed state. If no fix is available, treat isolation or removal from service as the control, not a temporary convenience.

What to verify: Keep proof of asset identification, remediation status, and post-change validation. Without that evidence, “patched” is only an assumption.

Practitioner takeaway: For chipset flaws like this, the real control is verified exposure reduction, either through the vendor remediation or by making the vulnerable product unreachable until it can be retired.