Use After Free in Qualcomm products - CVE-2022-25717
Published: January 10, 2023
Vulnerability identifier: #VU71031
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25717
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local privileged application can execute arbitrary code.
Affected software
WCD9370
SD429
SDA429W
SDXR1
WCD9326
WCD9335
WCD9340
WCD9341
WCN3610
WCN3620
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3990
WCN3998
WSA8810
WSA8815
QCA6574A
AQT1000
MDM9250
QCA6391
QCA6420
QCA6430
QCA6564A
QCA6564AU
QCA8337
QCN9074
QCS410
QCS610
Qualcomm215
SA515M
SA8155P
Pixel
SD835
SD855
SDM429W
SDX55
SD210
MDM9150
MDM9650
MSM8996AU
APQ8096AU
QCA6574AU
QCS8155
SD205
SD429
SDA429W
SDXR1
WCD9326
WCD9335
WCD9340
WCD9341
WCN3610
WCN3620
WCN3660B
WCN3680B
WCN3950
WCN3980
WCN3990
WCN3998
WSA8810
WSA8815
QCA6574A
AQT1000
MDM9250
QCA6391
QCA6420
QCA6430
QCA6564A
QCA6564AU
QCA8337
QCN9074
QCS410
QCS610
Qualcomm215
SA515M
SA8155P
Pixel
SD835
SD855
SDM429W
SDX55
SD210
MDM9150
MDM9650
MSM8996AU
APQ8096AU
QCA6574AU
QCS8155
SD205
How to mitigate CVE-2022-25717
Install security update from vendor's website.
Pixel - update to 2023-01-05