Integer overflow in Qualcomm products - CVE-2022-25656

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67087

Integer overflow in Qualcomm products - CVE-2022-25656

Published: September 8, 2022


Vulnerability identifier: #VU67087
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25656
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to integer overflow within the kernel component. A local application can trigger an integer overflow and execute arbitrary code with elevated privileges.



Affected software

WCD9326
WCN3980
WCN3950
WCD9385
WCD9380
WCD9375
WCD9370
WCD9341
WCD9335
WCN3988
SW5100P
SW5100
SM7325P
SM7315
SDXR2 5G
WCN3991
WCN3998
WCN6740
WCN6750
WCN6850
WCN6851
WCN6855
WCN6856
WCN7850
WCN7851
WSA8810
WSA8815
WSA8830
WSA8835
QCA6390
QCA6391
QCA6426
QCA6436
QCA6574
QCA6574A
QCA6595AU
QCA6696
QCA8081
QCA8337
QCM6490
QCS6490
AR8035
SA8155P
SA8195P
SD 8 Gen1 5G
SD460
SD480
SD695
SD778G
SD780G
SD865 5G
SD870
SD888 5G
SDX12
SDX55M
SDX65
SM8475P
SM8475
SM7450
WSA8832
SA6155P
QCA6174A
QCA6574AU
QCA9377
SD888
Google Android

How to mitigate CVE-2022-25656

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-09-05, 11 2022-09-05, 12L 2022-09-05, 12 2022-09-05, 13 2022-09-05

External References

Related Security Bulletins