#VU76854 Double Free in Qualcomm products - CVE-2022-40522

Vulnerability identifier: #VU76854

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-40522

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
CSR8811
FastConnect 6200
IPQ6000
IPQ6005
IPQ6010
IPQ6018
IPQ6028
IPQ9008
IPQ9574
QCA4024
QCA6574A
QCA6595AU
QCA6696
QCA8072
QCA8075
QCA8081
QCA8082
QCA8084
QCA8085
QCA8386
QCN5021
QCN5022
QCN5052
QCN5121
QCN5122
QCN5152
QCN6023
QCN6024
QCN9000
QCN9022
QCN9024
QCN9070
QCN9072
QCN9074
QCN9274
SA6145P
SA6150P
SA6155
SA8145P
SA8150P
SA8155
SA8155P
SA8195P
SM7250P
Snapdragon 765 5G Mobile Platform (SM7250-AA)
Snapdragon 765G 5G Mobile Platform (SM7250-AB)
Snapdragon 768G 5G Mobile Platform (SM7250-AC)
WCD9380
WCD9385
WSA8810
WSA8815
QCA6574AU
SA6155P

Software vendor:
Qualcomm

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Linux Networking. A local application can execute arbitrary code.

Install security update from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2023-bulletin.html