Vulnerability identifier: #VU76854

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40522

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
CSR8811
Mobile applications / Mobile firmware & hardware
FastConnect 6200
Mobile applications / Mobile firmware & hardware
IPQ6000
Mobile applications / Mobile firmware & hardware
IPQ6005
Mobile applications / Mobile firmware & hardware
IPQ6010
Mobile applications / Mobile firmware & hardware
IPQ6018
Mobile applications / Mobile firmware & hardware
IPQ6028
Mobile applications / Mobile firmware & hardware
IPQ9008
Mobile applications / Mobile firmware & hardware
IPQ9574
Mobile applications / Mobile firmware & hardware
QCA4024
Mobile applications / Mobile firmware & hardware
QCA6574A
Mobile applications / Mobile firmware & hardware
QCA6595AU
Mobile applications / Mobile firmware & hardware
QCA6696
Mobile applications / Mobile firmware & hardware
QCA8072
Mobile applications / Mobile firmware & hardware
QCA8075
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8082
Mobile applications / Mobile firmware & hardware
QCA8084
Mobile applications / Mobile firmware & hardware
QCA8085
Mobile applications / Mobile firmware & hardware
QCA8386
Mobile applications / Mobile firmware & hardware
QCN5021
Mobile applications / Mobile firmware & hardware
QCN5022
Mobile applications / Mobile firmware & hardware
QCN5052
Mobile applications / Mobile firmware & hardware
QCN5121
Mobile applications / Mobile firmware & hardware
QCN5122
Mobile applications / Mobile firmware & hardware
QCN5152
Mobile applications / Mobile firmware & hardware
QCN6023
Mobile applications / Mobile firmware & hardware
QCN6024
Mobile applications / Mobile firmware & hardware
QCN9000
Mobile applications / Mobile firmware & hardware
QCN9022
Mobile applications / Mobile firmware & hardware
QCN9024
Mobile applications / Mobile firmware & hardware
QCN9070
Mobile applications / Mobile firmware & hardware
QCN9072
Mobile applications / Mobile firmware & hardware
QCN9074
Mobile applications / Mobile firmware & hardware
QCN9274
Mobile applications / Mobile firmware & hardware
SA6145P
Mobile applications / Mobile firmware & hardware
SA6150P
Mobile applications / Mobile firmware & hardware
SA6155
Mobile applications / Mobile firmware & hardware
SA8145P
Mobile applications / Mobile firmware & hardware
SA8150P
Mobile applications / Mobile firmware & hardware
SA8155
Mobile applications / Mobile firmware & hardware
SA8155P
Mobile applications / Mobile firmware & hardware
SA8195P
Mobile applications / Mobile firmware & hardware
SM7250P
Mobile applications / Mobile firmware & hardware
Snapdragon 765 5G Mobile Platform (SM7250-AA)
Mobile applications / Mobile firmware & hardware
Snapdragon 765G 5G Mobile Platform (SM7250-AB)
Mobile applications / Mobile firmware & hardware
Snapdragon 768G 5G Mobile Platform (SM7250-AC)
Mobile applications / Mobile firmware & hardware
WCD9380
Mobile applications / Mobile firmware & hardware
WCD9385
Mobile applications / Mobile firmware & hardware
WSA8810
Mobile applications / Mobile firmware & hardware
WSA8815
Mobile applications / Mobile firmware & hardware
QCA6574AU
Hardware solutions / Firmware
SA6155P
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Linux Networking. A local application can execute arbitrary code.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

CSR8811: All versions

FastConnect 6200: All versions

IPQ6000: All versions

IPQ6005: All versions

IPQ6010: All versions

IPQ6018: All versions

IPQ6028: All versions

IPQ9008: All versions

IPQ9574: All versions

QCA4024: All versions

QCA6574A: All versions

QCA6574AU: All versions

QCA6595AU: All versions

QCA6696: All versions

QCA8072: All versions

QCA8075: All versions

QCA8081: All versions

QCA8082: All versions

QCA8084: All versions

QCA8085: All versions

QCA8386: All versions

QCN5021: All versions

QCN5022: All versions

QCN5052: All versions

QCN5121: All versions

QCN5122: All versions

QCN5152: All versions

QCN6023: All versions

QCN6024: All versions

QCN9000: All versions

QCN9022: All versions

QCN9024: All versions

QCN9070: All versions

QCN9072: All versions

QCN9074: All versions

QCN9274: All versions

SA6145P: All versions

SA6150P: All versions

SA6155: All versions

SA6155P: All versions

SA8145P: All versions

SA8150P: All versions

SA8155: All versions

SA8155P: All versions

SA8195P: All versions

SM7250P: All versions

Snapdragon 765 5G Mobile Platform (SM7250-AA): All versions

Snapdragon 765G 5G Mobile Platform (SM7250-AB): All versions

Snapdragon 768G 5G Mobile Platform (SM7250-AC): All versions

WCD9380: All versions

WCD9385: All versions

WSA8810: All versions

WSA8815: All versions

---

External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/june-2023-bulletin.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.