Buffer over-read in Qualcomm products - CVE-2022-40535

Vulnerability identifier: #VU72853

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40535

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

SD865 5G
SW5100P
SW5100
Snapdragon 4 Gen 1
SM4125
SDX65M
SDX65
SDX55M
SD870
WCD9326
SD695
SD680
SD662
SD480
SD460
QCN9274
QCN9074
QCN9072
WCN3988
WSA8835
WSA8830
WSA8815
WSA8810
WCN6851
WCN6850
WCN3998
WCN3991
QCN9070
WCN3980
WCN3950
WCN3910
WCD9385
WCD9380
WCD9375
WCD9370
WCD9335
IPQ8173
QCA6426
QCA6421
QCA6391
QCA6390
QCA4024
IPQ9574
IPQ9008
IPQ8174
QCA6431
IPQ8078A
IPQ8078
IPQ8076A
IPQ8076
IPQ8074A
IPQ8072A
IPQ8071A
IPQ8070A
QCA9889
QCN9024
QCN9000
QCN6024
QCN6023
QCN5164
QCN5154
QCN5124
QCN5024
CSR8811
QCA9888
QCA8386
QCA8085
QCA8084
QCA8082
QCA8081
QCA6436
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 11 2023-03-05, 12L 2023-03-05, 12 2023-03-05, 13 2023-03-05

• https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets
• Multiple vulnerabilities in Google Android