Buffer over-read in Qualcomm products - CVE-2022-33295

Vulnerability identifier: #VU74326

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33295

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Modem. A remote attacker can read and manipulate data.

9205 LTE Modem
9206 LTE Modem
9207 LTE Modem
MDM8207
QCA4004
QTS110
Snapdragon 1100 Wearable Platform
Snapdragon 1200 Wearable Platform
Snapdragon Wear 1300 Platform
Snapdragon X5 LTE Modem
WCD9306
WCD9330

Install security update from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets