Use-after-free in Qualcomm products - CVE-2022-22057

Vulnerability identifier: #VU63088

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22057

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in graphics fence caused by a race condition while closing fence file descriptor and destroy graphics timeline simultaneously. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

SW5100
WCN3615
WCD9385
WCD9380
WCD9375
WCD9370
WCD9341
WCD9335
WCD9326
SW5100P
WCN3660B
SM7325P
SM7315
SM7250P
SDXR2 5G
SDX65
SDX55M
SDX12
SD888 5G
WCN6850
WSA8835
WSA8830
WSA8815
WSA8810
WCN7851
WCN7850
WCN6856
WCN6855
WCN6851
SD870
WCN6750
WCN6740
WCN3998
WCN3991
WCN3988
WCN3980
WCN3950
WCN3910
WCN3680B
QCA8337
QRB5165M
QRB5165
QCS6490
QCS4290
QCS2290
QCM6490
QCM4290
QCM2290
QRB5165N
QCA8081
QCA6595AU
QCA6436
QCA6426
QCA6391
QCA6390
AR8035
SD680
SD865 5G
SD780G
SD778G
SD768G
SD765G
SD765
SD750G
SD695
SD690 5G
SD662
SD480
SD460
SD439
SD 8 Gen1 5G
SA8195P
SA8155P
Qualcomm215
SD888
QCA9377
QCA6174A
MSM8953
APQ8053
SA6155P

Install updates from vendor's website.

• Exploit #9979 - CVE-2022-22057_SM-F926U () (June 14, 2024)

• https://docs.qualcomm.com/bundle/publicresource/HD-10000-1/topics/may-2022-bulletin.html
• https://source.codeaurora.org/quic/la/kernel/msm-5.4/commit/?id=339824df70a0e9e08f2a7151b776d72421050f04

• Multiple vulnerabilities in Qualcomm chipsets