Multiple vulnerabilities in Qualcomm chipsets



Published: 2022-09-08
Risk High
Patch available YES
Number of vulnerabilities 23
CVE-ID CVE-2022-25686
CVE-2022-25654
CVE-2022-25706
CVE-2022-25693
CVE-2022-25670
CVE-2022-25656
CVE-2022-22095
CVE-2022-25653
CVE-2022-25696
CVE-2022-25690
CVE-2022-25688
CVE-2022-25669
CVE-2022-22105
CVE-2022-22094
CVE-2022-22093
CVE-2022-22092
CVE-2022-22091
CVE-2022-22089
CVE-2022-22081
CVE-2022-22074
CVE-2022-22066
CVE-2022-25708
CVE-2022-25652
CWE-ID CWE-119
CWE-125
CWE-416
CWE-190
CWE-367
CWE-129
CWE-285
CWE-126
CWE-287
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
APQ8017
Hardware solutions / Firmware

APQ8053
Hardware solutions / Firmware

MSM8917
Hardware solutions / Firmware

MSM8953
Hardware solutions / Firmware

QCA6574AU
Hardware solutions / Firmware

SA6155P
Hardware solutions / Firmware

SD665
Hardware solutions / Firmware

SD670
Hardware solutions / Firmware

SD675
Hardware solutions / Firmware

SD710
Hardware solutions / Firmware

SD730
Hardware solutions / Firmware

SD835
Hardware solutions / Firmware

SD855
Hardware solutions / Firmware

SD888
Hardware solutions / Firmware

SDM630
Hardware solutions / Firmware

SDX55
Hardware solutions / Firmware

SM7450
Hardware solutions / Firmware

SM8475
Hardware solutions / Firmware

SM8475P
Hardware solutions / Firmware

WSA8832
Hardware solutions / Firmware

APQ8096AU
Hardware solutions / Firmware

MDM9650
Hardware solutions / Firmware

QCA6174A
Hardware solutions / Firmware

QCS605
Hardware solutions / Firmware

SDM429W
Hardware solutions / Firmware

MSM8909W
Hardware solutions / Firmware

MSM8996AU
Hardware solutions / Firmware

SD450
Hardware solutions / Firmware

SD845
Hardware solutions / Firmware

APQ8009
Hardware solutions / Firmware

MDM9607
Hardware solutions / Firmware

MDM9640
Hardware solutions / Firmware

MSM8937
Hardware solutions / Firmware

QCA9377
Hardware solutions / Firmware

QCA9379
Hardware solutions / Firmware

QCS405
Hardware solutions / Firmware

SDX20
Hardware solutions / Firmware

QCN7605
Hardware solutions / Firmware

SD712
Hardware solutions / Firmware

SD850
Hardware solutions / Firmware

MDM9206
Hardware solutions / Firmware

MDM9150
Hardware solutions / Firmware

MSM8920
Hardware solutions / Firmware

MSM8940
Hardware solutions / Firmware

SDX24
Hardware solutions / Firmware

IPQ8074
Hardware solutions / Firmware

QCN6132
Hardware solutions / Firmware

AQT1000
Mobile applications / Mobile firmware & hardware

QCA6390
Mobile applications / Mobile firmware & hardware

QCA6391
Mobile applications / Mobile firmware & hardware

QCA6420
Mobile applications / Mobile firmware & hardware

QCA6426
Mobile applications / Mobile firmware & hardware

QCA6430
Mobile applications / Mobile firmware & hardware

QCA6436
Mobile applications / Mobile firmware & hardware

QCA6574
Mobile applications / Mobile firmware & hardware

QCA6574A
Mobile applications / Mobile firmware & hardware

QCA6595AU
Mobile applications / Mobile firmware & hardware

QCA6696
Mobile applications / Mobile firmware & hardware

QCM2290
Mobile applications / Mobile firmware & hardware

QCM4290
Mobile applications / Mobile firmware & hardware

QCM6490
Mobile applications / Mobile firmware & hardware

QCS2290
Mobile applications / Mobile firmware & hardware

QCS4290
Mobile applications / Mobile firmware & hardware

QCS6490
Mobile applications / Mobile firmware & hardware

Qualcomm215
Mobile applications / Mobile firmware & hardware

SA6155
Mobile applications / Mobile firmware & hardware

SA8155
Mobile applications / Mobile firmware & hardware

SA8155P
Mobile applications / Mobile firmware & hardware

SA8195P
Mobile applications / Mobile firmware & hardware

SD 636
Mobile applications / Mobile firmware & hardware

SD 675
Mobile applications / Mobile firmware & hardware

SD 8 Gen1 5G
Mobile applications / Mobile firmware & hardware

SD429
Mobile applications / Mobile firmware & hardware

SD439
Mobile applications / Mobile firmware & hardware

SD460
Mobile applications / Mobile firmware & hardware

SD480
Mobile applications / Mobile firmware & hardware

SD632
Mobile applications / Mobile firmware & hardware

SD660
Mobile applications / Mobile firmware & hardware

SD662
Mobile applications / Mobile firmware & hardware

SD678
Mobile applications / Mobile firmware & hardware

SD680
Mobile applications / Mobile firmware & hardware

SD690 5G
Mobile applications / Mobile firmware & hardware

SD695
Mobile applications / Mobile firmware & hardware

SD720G
Mobile applications / Mobile firmware & hardware

SD750G
Mobile applications / Mobile firmware & hardware

SD765
Mobile applications / Mobile firmware & hardware

SD765G
Mobile applications / Mobile firmware & hardware

SD768G
Mobile applications / Mobile firmware & hardware

SD778G
Mobile applications / Mobile firmware & hardware

SD780G
Mobile applications / Mobile firmware & hardware

SD865 5G
Mobile applications / Mobile firmware & hardware

SD870
Mobile applications / Mobile firmware & hardware

SD888 5G
Mobile applications / Mobile firmware & hardware

SDX50M
Mobile applications / Mobile firmware & hardware

SDX55M
Mobile applications / Mobile firmware & hardware

SDXR2 5G
Mobile applications / Mobile firmware & hardware

SM4125
Mobile applications / Mobile firmware & hardware

SM6250
Mobile applications / Mobile firmware & hardware

SM7250P
Mobile applications / Mobile firmware & hardware

SM7315
Mobile applications / Mobile firmware & hardware

SM7325P
Mobile applications / Mobile firmware & hardware

SW5100
Mobile applications / Mobile firmware & hardware

SW5100P
Mobile applications / Mobile firmware & hardware

WCD9326
Mobile applications / Mobile firmware & hardware

WCD9335
Mobile applications / Mobile firmware & hardware

WCD9340
Mobile applications / Mobile firmware & hardware

WCD9341
Mobile applications / Mobile firmware & hardware

WCD9370
Mobile applications / Mobile firmware & hardware

WCD9375
Mobile applications / Mobile firmware & hardware

WCD9380
Mobile applications / Mobile firmware & hardware

WCD9385
Mobile applications / Mobile firmware & hardware

WCN3615
Mobile applications / Mobile firmware & hardware

WCN3660B
Mobile applications / Mobile firmware & hardware

WCN3680
Mobile applications / Mobile firmware & hardware

WCN3680B
Mobile applications / Mobile firmware & hardware

WCN3910
Mobile applications / Mobile firmware & hardware

WCN3950
Mobile applications / Mobile firmware & hardware

WCN3980
Mobile applications / Mobile firmware & hardware

WCN3988
Mobile applications / Mobile firmware & hardware

WCN3990
Mobile applications / Mobile firmware & hardware

WCN3991
Mobile applications / Mobile firmware & hardware

WCN3998
Mobile applications / Mobile firmware & hardware

WCN6740
Mobile applications / Mobile firmware & hardware

WCN6750
Mobile applications / Mobile firmware & hardware

WCN6850
Mobile applications / Mobile firmware & hardware

WCN6851
Mobile applications / Mobile firmware & hardware

WCN6855
Mobile applications / Mobile firmware & hardware

WCN6856
Mobile applications / Mobile firmware & hardware

WCN7850
Mobile applications / Mobile firmware & hardware

WCN7851
Mobile applications / Mobile firmware & hardware

WSA8810
Mobile applications / Mobile firmware & hardware

WSA8815
Mobile applications / Mobile firmware & hardware

WSA8830
Mobile applications / Mobile firmware & hardware

WSA8835
Mobile applications / Mobile firmware & hardware

QCS603
Mobile applications / Mobile firmware & hardware

SD820
Mobile applications / Mobile firmware & hardware

WCN3620
Mobile applications / Mobile firmware & hardware

APQ8009W
Mobile applications / Mobile firmware & hardware

QCA6310
Mobile applications / Mobile firmware & hardware

QCA6320
Mobile applications / Mobile firmware & hardware

QCA6335
Mobile applications / Mobile firmware & hardware

QCA6564A
Mobile applications / Mobile firmware & hardware

QCA6564AU
Mobile applications / Mobile firmware & hardware

QCS610
Mobile applications / Mobile firmware & hardware

SA6145P
Mobile applications / Mobile firmware & hardware

SDW2500
Mobile applications / Mobile firmware & hardware

SDXR1
Mobile applications / Mobile firmware & hardware

SM6250P
Mobile applications / Mobile firmware & hardware

WCD9371
Mobile applications / Mobile firmware & hardware

WCN3660
Mobile applications / Mobile firmware & hardware

AR8031
Mobile applications / Mobile firmware & hardware

AR8035
Mobile applications / Mobile firmware & hardware

CSRA6620
Mobile applications / Mobile firmware & hardware

CSRA6640
Mobile applications / Mobile firmware & hardware

MDM9626
Mobile applications / Mobile firmware & hardware

MDM9628
Mobile applications / Mobile firmware & hardware

PM8937
Mobile applications / Mobile firmware & hardware

QCA4020
Mobile applications / Mobile firmware & hardware

QCA6175A
Mobile applications / Mobile firmware & hardware

QCA6584
Mobile applications / Mobile firmware & hardware

QCA8081
Mobile applications / Mobile firmware & hardware

QCA8337
Mobile applications / Mobile firmware & hardware

QCA9367
Mobile applications / Mobile firmware & hardware

QRB5165
Mobile applications / Mobile firmware & hardware

QRB5165M
Mobile applications / Mobile firmware & hardware

QRB5165N
Mobile applications / Mobile firmware & hardware

SDX12
Mobile applications / Mobile firmware & hardware

SDX65
Mobile applications / Mobile firmware & hardware

WCN3610
Mobile applications / Mobile firmware & hardware

WCN3999
Mobile applications / Mobile firmware & hardware

QCS410
Mobile applications / Mobile firmware & hardware

CSRB31024
Mobile applications / Mobile firmware & hardware

MDM9250
Mobile applications / Mobile firmware & hardware

QCA1062
Mobile applications / Mobile firmware & hardware

QCA1064
Mobile applications / Mobile firmware & hardware

QCA6421
Mobile applications / Mobile firmware & hardware

QCA6431
Mobile applications / Mobile firmware & hardware

QCA6564
Mobile applications / Mobile firmware & hardware

QCA6595
Mobile applications / Mobile firmware & hardware

QCA6694
Mobile applications / Mobile firmware & hardware

QCM6125
Mobile applications / Mobile firmware & hardware

QCN7606
Mobile applications / Mobile firmware & hardware

QCS6125
Mobile applications / Mobile firmware & hardware

QSM8350
Mobile applications / Mobile firmware & hardware

SA415M
Mobile applications / Mobile firmware & hardware

SA515M
Mobile applications / Mobile firmware & hardware

SC8180X+SDX55
Mobile applications / Mobile firmware & hardware

SD 8CX
Mobile applications / Mobile firmware & hardware

SD 8cx Gen2
Mobile applications / Mobile firmware & hardware

SD 8cx Gen3
Mobile applications / Mobile firmware & hardware

SD7c
Mobile applications / Mobile firmware & hardware

WCD9360
Mobile applications / Mobile firmware & hardware

WCD9330
Mobile applications / Mobile firmware & hardware

CSR8811
Mobile applications / Mobile firmware & hardware

IPQ5010
Mobile applications / Mobile firmware & hardware

IPQ5018
Mobile applications / Mobile firmware & hardware

IPQ5028
Mobile applications / Mobile firmware & hardware

IPQ6000
Mobile applications / Mobile firmware & hardware

IPQ6005
Mobile applications / Mobile firmware & hardware

IPQ6010
Mobile applications / Mobile firmware & hardware

IPQ6018
Mobile applications / Mobile firmware & hardware

IPQ6028
Mobile applications / Mobile firmware & hardware

IPQ8070
Mobile applications / Mobile firmware & hardware

IPQ8070A
Mobile applications / Mobile firmware & hardware

IPQ8071
Mobile applications / Mobile firmware & hardware

IPQ8071A
Mobile applications / Mobile firmware & hardware

IPQ8072
Mobile applications / Mobile firmware & hardware

IPQ8072A
Mobile applications / Mobile firmware & hardware

IPQ8074A
Mobile applications / Mobile firmware & hardware

IPQ8076
Mobile applications / Mobile firmware & hardware

IPQ8076A
Mobile applications / Mobile firmware & hardware

IPQ8078
Mobile applications / Mobile firmware & hardware

IPQ8078A
Mobile applications / Mobile firmware & hardware

IPQ8173
Mobile applications / Mobile firmware & hardware

IPQ8174
Mobile applications / Mobile firmware & hardware

PMP8074
Mobile applications / Mobile firmware & hardware

QCA4024
Mobile applications / Mobile firmware & hardware

QCA6428
Mobile applications / Mobile firmware & hardware

QCA6438
Mobile applications / Mobile firmware & hardware

QCA8072
Mobile applications / Mobile firmware & hardware

QCA8075
Mobile applications / Mobile firmware & hardware

QCA9888
Mobile applications / Mobile firmware & hardware

QCA9889
Mobile applications / Mobile firmware & hardware

QCN5021
Mobile applications / Mobile firmware & hardware

QCN5022
Mobile applications / Mobile firmware & hardware

QCN5024
Mobile applications / Mobile firmware & hardware

QCN5052
Mobile applications / Mobile firmware & hardware

QCN5054
Mobile applications / Mobile firmware & hardware

QCN5064
Mobile applications / Mobile firmware & hardware

QCN5121
Mobile applications / Mobile firmware & hardware

QCN5122
Mobile applications / Mobile firmware & hardware

QCN5124
Mobile applications / Mobile firmware & hardware

QCN5152
Mobile applications / Mobile firmware & hardware

QCN5154
Mobile applications / Mobile firmware & hardware

QCN5164
Mobile applications / Mobile firmware & hardware

QCN5550
Mobile applications / Mobile firmware & hardware

QCN6023
Mobile applications / Mobile firmware & hardware

QCN6024
Mobile applications / Mobile firmware & hardware

QCN6100
Mobile applications / Mobile firmware & hardware

QCN6102
Mobile applications / Mobile firmware & hardware

QCN6112
Mobile applications / Mobile firmware & hardware

QCN6122
Mobile applications / Mobile firmware & hardware

QCN9000
Mobile applications / Mobile firmware & hardware

QCN9012
Mobile applications / Mobile firmware & hardware

QCN9022
Mobile applications / Mobile firmware & hardware

QCN9024
Mobile applications / Mobile firmware & hardware

QCN9070
Mobile applications / Mobile firmware & hardware

QCN9072
Mobile applications / Mobile firmware & hardware

QCN9074
Mobile applications / Mobile firmware & hardware

QCN9100
Mobile applications / Mobile firmware & hardware

Vendor Qualcomm

Security Bulletin

This security bulletin contains information about 23 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU67081

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25686

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the video component when processing WAV files. A remote attacker can create a specially crafted WAV file, trick the victim into playing it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8017: All versions

APQ8053: All versions

AQT1000: All versions

MSM8917: All versions

MSM8953: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCM2290: All versions

QCM4290: All versions

QCM6490: All versions

QCS2290: All versions

QCS4290: All versions

QCS6490: All versions

Qualcomm215: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD439: All versions

SD460: All versions

SD480: All versions

SD632: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD835: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM630: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU67092

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25654

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing ION commands within kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8096AU: All versions

MDM9650: All versions

QCA6174A: All versions

QCA6574AU: All versions

QCS603: All versions

QCS605: All versions

Qualcomm215: All versions

SD429: All versions

SD820: All versions

SDM429W: All versions

WCD9326: All versions

WCD9335: All versions

WCD9341: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3980: All versions

WCN3990: All versions

WSA8810: All versions

WSA8815: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=940ac530d84408d1ec308c16ac777334c722fc91


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU67091

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25706

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within Bluetooth HOST when reading l2cap length. A remote attacker with physical proximity to the device can send specially crafted traffic to the system, trigger an out-of-bounds read error and read contents of memory or perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009W: All versions

APQ8017: All versions

APQ8053: All versions

APQ8096AU: All versions

AQT1000: All versions

MSM8909W: All versions

MSM8917: All versions

MSM8953: All versions

MSM8996AU: All versions

QCA6310: All versions

QCA6320: All versions

QCA6335: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCM2290: All versions

QCM4290: All versions

QCM6490: All versions

QCS2290: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6490: All versions

Qualcomm215: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD439: All versions

SD450: All versions

SD460: All versions

SD480: All versions

SD632: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD835: All versions

SD845: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM429W: All versions

SDM630: All versions

SDW2500: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/system/bt/-/commit/d4e26243378796cd6aa997d5e45bb87954ffc859


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU67090

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25693

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Graphics component. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SD 8 Gen1 5G: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN6750: All versions

WCN6855: All versions

WCN6856: All versions

WCN7851: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/c0d2d03debbedc696561cd7b3c503c4aeaabfa1a


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU67088

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25670

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the HOST WLAN component when unpacking frames. A remote attacker can send specially crafted traffic to the system, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009: All versions

APQ8009W: All versions

APQ8017: All versions

APQ8053: All versions

APQ8096AU: All versions

AQT1000: All versions

AR8031: All versions

AR8035: All versions

CSRA6620: All versions

CSRA6640: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9640: All versions

MDM9650: All versions

MSM8909W: All versions

MSM8917: All versions

MSM8937: All versions

MSM8953: All versions

PM8937: All versions

QCA4020: All versions

QCA6174A: All versions

QCA6175A: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6584: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9367: All versions

QCA9377: All versions

QCA9379: All versions

QCM2290: All versions

QCM4290: All versions

QCS2290: All versions

QCS405: All versions

QCS4290: All versions

QCS605: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

Qualcomm215: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD439: All versions

SD450: All versions

SD460: All versions

SD632: All versions

SD662: All versions

SD675: All versions

SD678: All versions

SD690 5G: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888 5G: All versions

SDW2500: All versions

SDX12: All versions

SDX20: All versions

SDX55: All versions

SDX55M: All versions

SDX65: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3610: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/-/commit/a04ffeff1199e6d34864389624b92b9acf8c8fb3
http://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/-/commit/f0b0920c43f0744b6562bfa38278e38cb9c8b010


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU67087

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25656

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to integer overflow within the kernel component. A local application can trigger an integer overflow and execute arbitrary code with elevated privileges.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

AR8035: All versions

QCA6174A: All versions

QCA6390: All versions

QCA6391: All versions

QCA6426: All versions

QCA6436: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9377: All versions

QCM6490: All versions

QCS6490: All versions

SA6155P: All versions

SA8155P: All versions

SA8195P: All versions

SD 8 Gen1 5G: All versions

SD460: All versions

SD480: All versions

SD695: All versions

SD778G: All versions

SD780G: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX12: All versions

SDX55M: All versions

SDX65: All versions

SDXR2 5G: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://git.codelinaro.org/clo/la/kernel/msm-5.4/-/commit/31ff75796c8ce7474080bc121c25491d36a075ba
http://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/7a671fab89802eaebce00e3858698b4bdc9595de
http://git.codelinaro.org/clo/la/kernel/msm-5.4/-/commit/501d0efe7525de1456b444a6f7f30b50a0d22582
http://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/470047b5c89944fe84737b1f529edd5b1c185782


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU67086

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22095

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the synx driver of Multimedia Frameworks. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8053: All versions

MSM8953: All versions

QCA6390: All versions

QCA6391: All versions

QCA6426: All versions

QCA6436: All versions

QCM2290: All versions

QCM4290: All versions

QCS2290: All versions

QCS4290: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

SD439: All versions

SD460: All versions

SD662: All versions

SD680: All versions

SD690 5G: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SDX55: All versions

SDX55M: All versions

SDXR2 5G: All versions

SM4125: All versions

SM7250P: All versions

WCD9326: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3988: All versions

WCN3991: All versions

WCN3998: All versions

WCN6850: All versions

WCN6851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
http://source.codeaurora.org/quic/le/kernel/msm-4.19/commit/?id=7084d65ae1a81ea81fba243420f7f79dea13d76f
http://git.codelinaro.org/clo/la/kernel/msm-4.19/-/commit/f7cafe03ab52465acfba2e62c6b4da354723cee3


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU67085

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25653

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing AVI files. A remote attacker can create a specially crafted AVI file, trick the victim into playing it, trigger an out-of-bounds read error and read contents of memory on the system or crash the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8053: All versions

AQT1000: All versions

MSM8953: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCM4290: All versions

QCM6490: All versions

QCS410: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6490: All versions

Qualcomm215: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD460: All versions

SD480: All versions

SD662: All versions

SD665: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM429W: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU67084

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25696

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a race condition during map or unmap operations within the Display component. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8053: All versions

AQT1000: All versions

MSM8953: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6430: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCM2290: All versions

QCM4290: All versions

QCM6490: All versions

QCS2290: All versions

QCS4290: All versions

QCS6490: All versions

Qualcomm215: All versions

SA6155P: All versions

SA8155P: All versions

SA8195P: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD439: All versions

SD460: All versions

SD480: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SM4125: All versions

SM6250: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper Validation of Array Index

EUVDB-ID: #VU67083

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25690

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error in WLAN firmware when parsing ANQP action frames. A remote attacker on the local network can send specially crafted packets to the affected device and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8096AU: All versions

AQT1000: All versions

AR8031: All versions

AR8035: All versions

CSRA6620: All versions

CSRA6640: All versions

CSRB31024: All versions

MDM9250: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9640: All versions

MDM9650: All versions

MSM8996AU: All versions

QCA1062: All versions

QCA1064: All versions

QCA6174A: All versions

QCA6175A: All versions

QCA6310: All versions

QCA6320: All versions

QCA6335: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCA6564: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595: All versions

QCA6595AU: All versions

QCA6694: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9379: All versions

QCM2290: All versions

QCM4290: All versions

QCM6125: All versions

QCM6490: All versions

QCN7605: All versions

QCN7606: All versions

QCS2290: All versions

QCS405: All versions

QCS410: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6125: All versions

QCS6490: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

QSM8350: All versions

SA415M: All versions

SA515M: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SC8180X+SDX55: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD 8CX: All versions

SD 8cx Gen2: All versions

SD 8cx Gen3: All versions

SD460: All versions

SD480: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD712: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD7c: All versions

SD820: All versions

SD835: All versions

SD845: All versions

SD850: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM630: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDX65: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

WCD9326: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9360: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU67082

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25688

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the video component when processing PS files. A remote attacker can create a specially crafted PS file, trick the victim into playing it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009: All versions

APQ8009W: All versions

APQ8017: All versions

APQ8053: All versions

APQ8096AU: All versions

AQT1000: All versions

AR8031: All versions

CSRA6620: All versions

CSRA6640: All versions

MDM9206: All versions

MDM9250: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9650: All versions

MSM8909W: All versions

MSM8917: All versions

MSM8953: All versions

MSM8996AU: All versions

QCA4020: All versions

QCA6174A: All versions

QCA6310: All versions

QCA6320: All versions

QCA6335: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCA6564: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA9367: All versions

QCA9377: All versions

QCA9379: All versions

QCM2290: All versions

QCM4290: All versions

QCM6490: All versions

QCS2290: All versions

QCS405: All versions

QCS410: All versions

QCS4290: All versions

QCS605: All versions

QCS610: All versions

QCS6490: All versions

Qualcomm215: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD439: All versions

SD450: All versions

SD460: All versions

SD480: All versions

SD632: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD835: All versions

SD845: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM429W: All versions

SDM630: All versions

SDW2500: All versions

SDX20: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9330: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3610: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU67080

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25669

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the video component when processing MP4 files. A remote attacker can create a specially crafted MP4 file, trick the victim into playing it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009: All versions

APQ8009W: All versions

APQ8053: All versions

APQ8096AU: All versions

AQT1000: All versions

AR8031: All versions

CSRA6620: All versions

CSRA6640: All versions

MDM9206: All versions

MDM9250: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9650: All versions

MSM8909W: All versions

MSM8953: All versions

MSM8996AU: All versions

QCA4020: All versions

QCA6174A: All versions

QCA6310: All versions

QCA6320: All versions

QCA6335: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6426: All versions

QCA6430: All versions

QCA6436: All versions

QCA6564: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA9367: All versions

QCA9377: All versions

QCA9379: All versions

QCM4290: All versions

QCM6490: All versions

QCS405: All versions

QCS410: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6490: All versions

Qualcomm215: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD429: All versions

SD439: All versions

SD460: All versions

SD480: All versions

SD660: All versions

SD662: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD835: All versions

SD845: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM429W: All versions

SDW2500: All versions

SDX20: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9330: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3610: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Integer overflow

EUVDB-ID: #VU67041

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22105

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Automotive Connectivity component when processing HFP-UNIT profile. A attacker with physical proximity to device can send specially crafted data to the system, trigger an integer overflow and execute arbitrary code.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009: All versions

APQ8017: All versions

APQ8053: All versions

APQ8096AU: All versions

AR8031: All versions

CSRA6620: All versions

CSRA6640: All versions

CSRB31024: All versions

MDM9150: All versions

MDM9250: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9640: All versions

MDM9650: All versions

QCA4020: All versions

QCA6174A: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6584: All versions

QCA6595: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA9367: All versions

QCA9377: All versions

QCA9379: All versions

QCS405: All versions

SA415M: All versions

SA515M: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SDX20: All versions

SDX55: All versions

WCD9326: All versions

WCD9335: All versions

WCD9360: All versions

WCN3610: All versions

WCN3615: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3980: All versions

WCN3998: All versions

WCN3999: All versions

WSA8810: All versions

WSA8815: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU67079

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22094

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a race condition when getting mapping reference within the kernel component. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AQT1000: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCM6490: All versions

QCS6490: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

QSM8350: All versions

SD 8 Gen1 5G: All versions

SD 8CX: All versions

SD 8cx Gen2: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX55M: All versions

SDXR2 5G: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU67078

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22093

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a race condition when handling concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AQT1000: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCM6490: All versions

QCS6490: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

QSM8350: All versions

SD 8 Gen1 5G: All versions

SD 8CX: All versions

SD 8cx Gen2: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX55M: All versions

SDXR2 5G: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU67077

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22092

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kernel component. A local application can trigger a use-after-free error and execute arbitrary code with elevated privileges.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

AR8035: All versions

QCA6390: All versions

QCA6391: All versions

QCA6421: All versions

QCA6426: All versions

QCA6431: All versions

QCA6436: All versions

QCA8081: All versions

QCA8337: All versions

QCM6490: All versions

QCS6490: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

QSM8350: All versions

SD 8 Gen1 5G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX55M: All versions

SDX65: All versions

SDXR2 5G: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper Authorization

EUVDB-ID: #VU67075

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22091

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists within the LTE component due to improper authorization of a replayed LTE security mode command. A remote attacker can send specially crafted packets to the affected device and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8017: All versions

APQ8053: All versions

AQT1000: All versions

AR8035: All versions

CSRB31024: All versions

MSM8917: All versions

MSM8920: All versions

MSM8940: All versions

MSM8953: All versions

QCA6174A: All versions

QCA6310: All versions

QCA6335: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCA6564AU: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9377: All versions

QCM2290: All versions

QCM4290: All versions

QCM6125: All versions

QCS2290: All versions

QCS410: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6125: All versions

Qualcomm215: All versions

SA415M: All versions

SA515M: All versions

SC8180X+SDX55: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD 8cx Gen2: All versions

SD429: All versions

SD439: All versions

SD450: All versions

SD460: All versions

SD480: All versions

SD632: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD670: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD712: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD7c: All versions

SD845: All versions

SD850: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDM630: All versions

SDX20: All versions

SDX24: All versions

SDX55: All versions

SDX55M: All versions

SDX65: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9360: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3615: All versions

WCN3660: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Integer overflow

EUVDB-ID: #VU67074

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22089

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the audio module when processing records. A remote attacker can trick the victim to play a specially crafted file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AR8035: All versions

QCA8081: All versions

QCA8337: All versions

SD 8 Gen1 5G: All versions

SDX65: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3980: All versions

WCN3988: All versions

WCN6750: All versions

WCN6855: All versions

WCN6856: All versions

WCN7851: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Integer overflow

EUVDB-ID: #VU67073

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22081

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the audio module. A remote attacker can trick the victim to play a specially crafted media file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AR8035: All versions

QCA6595AU: All versions

QCA8081: All versions

QCA8337: All versions

SA6155P: All versions

SA8155P: All versions

SA8195P: All versions

SD 8 Gen1 5G: All versions

SD888 5G: All versions

SDX65: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3980: All versions

WCN3988: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7851: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Integer overflow

EUVDB-ID: #VU67045

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22074

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Audio component when processing WMA files. A remote attacker can trick the victim to open a specially crafted WMA file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

APQ8009: All versions

APQ8009W: All versions

APQ8017: All versions

APQ8053: All versions

APQ8096AU: All versions

AQT1000: All versions

AR8031: All versions

AR8035: All versions

CSRA6620: All versions

CSRA6640: All versions

CSRB31024: All versions

MDM9150: All versions

MDM9206: All versions

MDM9250: All versions

MDM9607: All versions

MDM9626: All versions

MDM9628: All versions

MDM9640: All versions

MDM9650: All versions

MSM8909W: All versions

MSM8917: All versions

MSM8937: All versions

MSM8953: All versions

MSM8996AU: All versions

PM8937: All versions

QCA4020: All versions

QCA6174A: All versions

QCA6310: All versions

QCA6320: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6584: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9367: All versions

QCA9377: All versions

QCA9379: All versions

QCM2290: All versions

QCM4290: All versions

QCM6125: All versions

QCS2290: All versions

QCS405: All versions

QCS410: All versions

QCS4290: All versions

QCS603: All versions

QCS605: All versions

QCS610: All versions

QCS6125: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

Qualcomm215: All versions

SA415M: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SD 636: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD 8cx Gen2: All versions

SD429: All versions

SD439: All versions

SD450: All versions

SD460: All versions

SD480: All versions

SD632: All versions

SD660: All versions

SD662: All versions

SD665: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD780G: All versions

SD835: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888 5G: All versions

SDM429W: All versions

SDM630: All versions

SDW2500: All versions

SDX20: All versions

SDX24: All versions

SDX55: All versions

SDX55M: All versions

SDX65: All versions

SDXR1: All versions

SDXR2 5G: All versions

SM7250P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9330: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3610: All versions

WCN3615: All versions

WCN3620: All versions

WCN3660: All versions

WCN3660B: All versions

WCN3680: All versions

WCN3680B: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer Over-read

EUVDB-ID: #VU67044

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22066

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a buffer over-read in the content protection feature when processing command received from HLOS. A local application can trigger a boundary error and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AQT1000: All versions

AR8031: All versions

AR8035: All versions

CSRA6620: All versions

CSRA6640: All versions

CSRB31024: All versions

MDM9150: All versions

QCA6174A: All versions

QCA6175A: All versions

QCA6390: All versions

QCA6391: All versions

QCA6420: All versions

QCA6421: All versions

QCA6426: All versions

QCA6430: All versions

QCA6431: All versions

QCA6436: All versions

QCA6564: All versions

QCA6564A: All versions

QCA6564AU: All versions

QCA6574: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8081: All versions

QCA8337: All versions

QCA9377: All versions

QCM2290: All versions

QCM4290: All versions

QCM6125: All versions

QCM6490: All versions

QCS2290: All versions

QCS405: All versions

QCS410: All versions

QCS4290: All versions

QCS610: All versions

QCS6125: All versions

QCS6490: All versions

QRB5165: All versions

QRB5165M: All versions

QRB5165N: All versions

QSM8350: All versions

SA415M: All versions

SA515M: All versions

SA6145P: All versions

SA6155: All versions

SA6155P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SC8180X+SDX55: All versions

SD 675: All versions

SD 8 Gen1 5G: All versions

SD 8cx Gen2: All versions

SD 8cx Gen3: All versions

SD460: All versions

SD480: All versions

SD662: All versions

SD665: All versions

SD675: All versions

SD678: All versions

SD680: All versions

SD690 5G: All versions

SD695: All versions

SD710: All versions

SD720G: All versions

SD730: All versions

SD750G: All versions

SD765: All versions

SD765G: All versions

SD768G: All versions

SD778G: All versions

SD780G: All versions

SD7c: All versions

SD855: All versions

SD865 5G: All versions

SD870: All versions

SD888: All versions

SD888 5G: All versions

SDX24: All versions

SDX50M: All versions

SDX55: All versions

SDX55M: All versions

SDX65: All versions

SDXR2 5G: All versions

SM4125: All versions

SM6250: All versions

SM6250P: All versions

SM7250P: All versions

SM7315: All versions

SM7325P: All versions

SM7450: All versions

SM8475: All versions

SM8475P: All versions

SW5100: All versions

SW5100P: All versions

WCD9326: All versions

WCD9335: All versions

WCD9340: All versions

WCD9341: All versions

WCD9360: All versions

WCD9370: All versions

WCD9371: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN3910: All versions

WCN3950: All versions

WCN3980: All versions

WCN3988: All versions

WCN3990: All versions

WCN3991: All versions

WCN3998: All versions

WCN3999: All versions

WCN6740: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8810: All versions

WSA8815: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Buffer overflow

EUVDB-ID: #VU67043

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25708

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WLAN Firmware when processing keys. A remote attacker on the local network can send specially crafted input to the affected device, trigger memory corruption and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SD 8 Gen1 5G: All versions

SD888 5G: All versions

SM7450: All versions

WCD9370: All versions

WCD9375: All versions

WCD9380: All versions

WCD9385: All versions

WCN6750: All versions

WCN6850: All versions

WCN6851: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Improper Authentication

EUVDB-ID: #VU67042

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25652

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a local application to bypass authentication process.

The vulnerability exists due to improper hash verification in WIN CoreBSP implementation. A local application can bypass authentication process and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

CSR8811: All versions

IPQ5010: All versions

IPQ5018: All versions

IPQ5028: All versions

IPQ6000: All versions

IPQ6005: All versions

IPQ6010: All versions

IPQ6018: All versions

IPQ6028: All versions

IPQ8070: All versions

IPQ8070A: All versions

IPQ8071: All versions

IPQ8071A: All versions

IPQ8072: All versions

IPQ8072A: All versions

IPQ8074: All versions

IPQ8074A: All versions

IPQ8076: All versions

IPQ8076A: All versions

IPQ8078: All versions

IPQ8078A: All versions

IPQ8173: All versions

IPQ8174: All versions

PMP8074: All versions

QCA4024: All versions

QCA6428: All versions

QCA6438: All versions

QCA8072: All versions

QCA8075: All versions

QCA8081: All versions

QCA9888: All versions

QCA9889: All versions

QCN5021: All versions

QCN5022: All versions

QCN5024: All versions

QCN5052: All versions

QCN5054: All versions

QCN5064: All versions

QCN5121: All versions

QCN5122: All versions

QCN5124: All versions

QCN5152: All versions

QCN5154: All versions

QCN5164: All versions

QCN5550: All versions

QCN6023: All versions

QCN6024: All versions

QCN6100: All versions

QCN6102: All versions

QCN6112: All versions

QCN6122: All versions

QCN6132: All versions

QCN9000: All versions

QCN9012: All versions

QCN9022: All versions

QCN9024: All versions

QCN9070: All versions

QCN9072: All versions

QCN9074: All versions

QCN9100: All versions

External links

http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###