Integer overflow in Qualcomm products - CVE-2022-22081

Vulnerability identifier: #VU67073

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22081

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the audio module. A remote attacker can trick the victim to play a specially crafted media file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

WCD9370
WSA8835
WSA8830
WCN7851
WCN6856
WCN6855
WCN6851
WCN6850
WCN6750
WCN3988
WCN3980
WCD9385
WCD9380
WCD9375
AR8035
SW5100P
SW5100
SDX65
SD888 5G
SD 8 Gen1 5G
SA8195P
SA8155P
QCA8337
QCA8081
QCA6595AU
WSA8832
SM8475P
SM8475
SM7450
SA6155P
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-09-05, 11 2022-09-05, 12L 2022-09-05, 12 2022-09-05, 13 2022-09-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android