Integer overflow in Qualcomm products - CVE-2022-22089

Vulnerability identifier: #VU67074

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22089

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the audio module when processing records. A remote attacker can trick the victim to play a specially crafted file, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

WCD9375
WSA8835
WSA8830
WCN7851
WCN6856
WCN6855
WCN6750
WCN3988
WCN3980
WCD9385
WCD9380
AR8035
WCD9370
SW5100P
SW5100
SDX65
SD 8 Gen1 5G
QCA8337
QCA8081
WSA8832
SM8475P
SM8475
SM7450
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-09-05, 11 2022-09-05, 12L 2022-09-05, 12 2022-09-05, 13 2022-09-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android