Resource exhaustion in Qualcomm products - CVE-2022-22101
Published: July 7, 2022
Vulnerability identifier: #VU64995
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22101
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources while parsing an incoming HAB messages. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
SA6150P
SA8295P
SA8195P
SA8155P
SA8150P
SA8145P
SA6145P
QCA6696
QCA6574A
QCA6564AU
QCA6564A
QAM8295P
SA9000P
SA8540P
SA6155P
APQ8096AU
QCA6574AU
SA8295P
SA8195P
SA8155P
SA8150P
SA8145P
SA6145P
QCA6696
QCA6574A
QCA6564AU
QCA6564A
QAM8295P
SA9000P
SA8540P
SA6155P
APQ8096AU
QCA6574AU
How to mitigate CVE-2022-22101
Install updates from vendor's website.