SB2023030642 - Multiple vulnerabilities in Qualcomm chipsets
Published: March 6, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Reachable Assertion (CVE-ID: CVE-2022-33244)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
2) Buffer overflow (CVE-ID: CVE-2022-40540)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux Kernel. A local application can execute arbitrary code.
3) Buffer over-read (CVE-ID: CVE-2022-40535)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.
4) Incorrect Type Conversion or Cast (Type Conversion) (CVE-ID: CVE-2022-40531)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN. A local application can execute arbitrary code.
5) Integer overflow (CVE-ID: CVE-2022-40530)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN. A local application can execute arbitrary code.
6) Reachable Assertion (CVE-ID: CVE-2022-40527)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Embedded SW. A remote attacker can perform a denial of service (DoS) attack.
7) Double Free (CVE-ID: CVE-2022-40515)
The vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to improper input validation in Video. A remote attacker can read and manipulate data.
8) Buffer over-read (CVE-ID: CVE-2022-33309)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware.. A remote attacker can perform a denial of service (DoS) attack.
9) Buffer overflow (CVE-ID: CVE-2022-33278)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in HLOS. A local application can execute arbitrary code.
10) Reachable Assertion (CVE-ID: CVE-2022-33272)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
11) Reachable Assertion (CVE-ID: CVE-2022-33254)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
12) Reachable Assertion (CVE-ID: CVE-2022-33250)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
13) Improper Authentication (CVE-ID: CVE-2022-33242)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Qualcomm IPC. A local application can execute arbitrary code.
14) Stack-based buffer overflow (CVE-ID: CVE-2022-33213)
The vulnerability allows a remote application to execute arbitrary code.
The vulnerability exists due to improper input validation in MODEM. A remote application can execute arbitrary code.
15) Buffer overflow (CVE-ID: CVE-2022-25655)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
16) Improper Access Control (CVE-ID: CVE-2022-40539)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive Android OS. A local application can execute arbitrary code.
17) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2022-33257)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Core. A local application can execute arbitrary code.
18) Improper Validation of Array Index (CVE-ID: CVE-2022-33256)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Multi-mode call processor. A remote attacker can execute arbitrary code.
19) Stack-based buffer overflow (CVE-ID: CVE-2022-33260)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in Core. A local application can read and manipulate data.
20) Use After Free (CVE-ID: CVE-2022-33245)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN. A local privileged application can execute arbitrary code.
21) Improper Validation of Array Index (CVE-ID: CVE-2022-40537)
The vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to improper input validation in Bluetooth HOST. A remote attacker can read and manipulate data.
22) Information Exposure (CVE-ID: CVE-2022-22075)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation in Graphics. A local application can gain access to sensitive information.
23) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2022-25709)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data Modem. A local application can execute arbitrary code.
24) Integer overflow (CVE-ID: CVE-2022-25705)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Modem. A local application can execute arbitrary code.
25) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2022-25694)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in MODEM. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.