Information disclosure in Qualcomm products - CVE-2022-25667

Vulnerability identifier: #VU69015

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25667

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by Kernel when handling ICMP requests. A remote attacker can gain unauthorized access to sensitive information on the system.

QCN5022
QCN5164
QCN5154
QCN5152
QCN5124
QCN5122
QCN5054
QCN5052
QCN5024
QCN6023
QCA9994
QCA9992
QCA9990
QCA9985
QCA9984
QCA9898
QCA9889
QCN9001
QCN9100
QCN9074
QCN9072
QCN9070
QCN9024
QCN9022
QCN9003
QCN9002
QCA9888
QCN9000
QCN6122
QCN6112
QCN6102
QCN6100
QCN6024
IPQ5028
IPQ8070A
IPQ8068
IPQ8065
IPQ6028
IPQ6018
IPQ6010
IPQ6000
IPQ8071A
IPQ5018
IPQ5010
IPQ4029
IPQ4028
IPQ4018
CSR8811
IPQ8174
QCA9886
QCA9880
QCA8081
QCA8075
QCA8072
QCA7500
QCA4024
IPQ9008
AR9380
IPQ8173
IPQ8078A
IPQ8078
IPQ8076A
IPQ8076
IPQ8074A
IPQ8072A
QCA9980
QCN6132
IPQ8064
IPQ4019
Aruba InstantOS
ArubaOS (AOS)

Install updates from vendor's website.

Aruba InstantOS - addressed in versions 6.4.4.8-4.2.4.22, 6.5.4.25, 8.6.0.21, 8.10.0.7, 8.11.1.1
ArubaOS (AOS) - update to 10.4.0.2

• https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2022-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in ArubaOS and InstantOS