Buffer overflow in Qualcomm Hardware solutions

#VU69957 Buffer overflow in Qualcomm Hardware solutions

Published: 2022-12-06

Vulnerability identifier: #VU69957

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25697

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vendor: Qualcomm

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in i2c buses when reading address configuration from i2c driver. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SD 8 Gen1 5G: All versions

SD429: All versions

SDA429W: All versions

SDM429W: All versions

WCD9380: All versions

WCN3610: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3980: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8830: All versions

WSA8835: All versions

External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/december-2022-bulletin.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

Multiple vulnerabilities in Google Android

Multiple vulnerabilities in Qualcomm chipsets