Memory Corruption Vulnerability in Qualcomm Snapdragon Products
CVE-2022-25677

6.7MEDIUM

Key Information:

Vendor
Qualcomm
Status
Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure And Networking
Vendor
CVE Published:
13 December 2022

Summary

A memory corruption issue exists within Qualcomm's Snapdragon product line due to improper handling of memory during the processing of DCI packets. This type of vulnerability arises from a use-after-free scenario, where memory that has already been released is accessed again, potentially leading to arbitrary code execution or system instability. Affected systems include a broad range of Snapdragon platforms, which are widely utilized in automotive, industrial, mobile, consumer IoT, and networking applications. Prompt attention to this vulnerability is essential for maintaining system integrity and security.

Affected Version(s)

Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking APQ8096AU

Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking AQT1000

Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking AR9380

References

https://www.qualcomm.com/company/product-security/bulleti...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.