Use of Out-of-range Pointer Offset in Qualcomm products - CVE-2022-25709

Vulnerability identifier: #VU72841

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25709

CWE-ID: CWE-823

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Data Modem. A local application can execute arbitrary code.

SM6250P
WCD9380
WCD9375
WCD9370
WCD9341
WCD9340
WCD9335
Snapdragon 4 Gen 1
SM7250P
WCD9385
SM6250
SDXR2 5G
SDX70M
SDX65
SDX55M
SD870
WCN6851
WSA8835
WSA8830
WSA8815
WSA8810
WCN7851
WCN7850
WCN6856
WCN6855
SD865 5G
WCN6850
WCN3998
WCN3991
WCN3990
WCN3988
WCN3980
WCN3950
QCA6431
SD 675
SA515M
QCX315
QCN9024
QCN6024
QCA8337
QCA8081
QCA6436
SD 8 Gen1 5G
QCA6426
QCA6421
QCA6391
QCA6390
QCA6320
QCA6310
SD750G
SD821
SD820
SD7c
SD768G
SD765G
SD765
AR8035
SD720G
SD695
SD690 5G
SD678
SD480
SDX55
QCA6174A
SD855
SD835
SD730
SD675
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 11 2023-03-05, 12L 2023-03-05, 12 2023-03-05, 13 2023-03-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android