SB2023011085 - Multiple vulnerabilities in Qualcomm chipsets

Description

This security bulletin contains information about 30 vulnerabilities.

1) Use After Free (CVE-ID: CVE-2022-25725)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in MODEM. A local application can perform a denial of service (DoS) attack.

2) Stack-based buffer overflow (CVE-ID: CVE-2022-40520)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A local user can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Out-of-bounds read (CVE-ID: CVE-2022-40519)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A local user can trigger out-of-bounds read error and read contents of memory on the system.

4) Out-of-bounds read (CVE-ID: CVE-2022-40518)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A local user can trigger out-of-bounds read error and read contents of memory on the system.

5) Stack-based buffer overflow (CVE-ID: CVE-2022-40517)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A local user can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Stack-based buffer overflow (CVE-ID: CVE-2022-40516)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A local user can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

7) Buffer over-read (CVE-ID: CVE-2022-22079)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in BOOT. A local attacker can perform a denial of service (DoS) attack.

8) Incorrect Type Conversion or Cast (Type Conversion) (CVE-ID: CVE-2022-25715)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Display driver. A local privileged application can execute arbitrary code.

9) Use After Free (CVE-ID: CVE-2022-25717)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Display. A local privileged application can execute arbitrary code.

10) Incorrect Type Conversion or Cast (Type Conversion) (CVE-ID: CVE-2022-25721)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Video driver. A local privileged application can execute arbitrary code.

11) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2022-25716)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Multimedia Framework. A local privileged application can execute arbitrary code.

12) Information Exposure (CVE-ID: CVE-2022-25722)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to read and manipulate data.

The vulnerability exists due to improper input validation in DSP Services. A local privileged application can read and manipulate data.

13) Memory corruption (CVE-ID: CVE-2022-33218)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Automotive. A local privileged application can execute arbitrary code.

14) Integer overflow (CVE-ID: CVE-2022-33219)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Automotive. A local application can execute arbitrary code.

15) Information Exposure (CVE-ID: CVE-2022-33265)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Powerline Communication Firmware. A remote attacker can read and manipulate data.

16) Buffer over-read (CVE-ID: CVE-2022-33253)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

17) Buffer overflow (CVE-ID: CVE-2022-25746)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Kernel. A local privileged application can execute arbitrary code.

18) Buffer over-read (CVE-ID: CVE-2022-33255)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can read and manipulate data.

19) Buffer over-read (CVE-ID: CVE-2022-33252)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can read and manipulate data.

20) Integer overflow (CVE-ID: CVE-2022-33266)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to improper input validation in Audio. A local application can read and manipulate data.

21) Improper Validation of Array Index (CVE-ID: CVE-2022-33274)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Android Core. A local application can execute arbitrary code.

22) Buffer overflow (CVE-ID: CVE-2022-33276)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Modem. A local application can execute arbitrary code.

23) Buffer over-read (CVE-ID: CVE-2022-33283)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can read and manipulate data.

24) Buffer over-read (CVE-ID: CVE-2022-33284)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can read and manipulate data.

25) Buffer over-read (CVE-ID: CVE-2022-33285)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

26) Buffer over-read (CVE-ID: CVE-2022-33286)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

27) NULL Pointer Dereference (CVE-ID: CVE-2022-33290)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can perform a denial of service (DoS) attack.

28) NULL Pointer Dereference (CVE-ID: CVE-2022-33299)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can perform a denial of service (DoS) attack.

29) Memory corruption (CVE-ID: CVE-2022-33300)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Automotive Android OS. A local application can execute arbitrary code.

30) Integer overflow (CVE-ID: CVE-2022-22088)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2023-bulletin.html