Buffer over-read in Qualcomm Hardware solutions

#VU71950 Buffer over-read in Qualcomm Hardware solutions

Published: 2023-02-07

Vulnerability identifier: #VU71950

Vulnerability risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-33221

CWE-ID: CWE-126

Exploitation vector: Local

Exploit availability: No

Vendor: Qualcomm

Description

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to improper input validation in Trusted Execution Environment. A local application can read and manipulate data.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

SD 8 Gen1 5G: All versions

SSG2115P: All versions

SSG2125P: All versions

SXR1230P: All versions

SXR2230P: All versions

WCD9380: All versions

WCD9385: All versions

WCN6855: All versions

WCN6856: All versions

WCN7850: All versions

WCN7851: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/february-2023-bulletin.html

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.