by Kastro
Paper/Archive/CVE-2022-33259

CVE-2022-33259

Qualcomm, Inc. Snapdragon — Buffer copy without checking the size of input in Modem

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.0.360 × 207.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.

Affected

ProductAffectedFixed inSource
Snapdragon9205 LTE Modem–CNA
Snapdragon9206 LTE Modem–CNA
Snapdragon9207 LTE Modem–CNA
SnapdragonMDM8207–CNA
SnapdragonQCA4004–CNA
SnapdragonQTS110–CNA
SnapdragonSnapdragon 1100 Wearable Platform–CNA
SnapdragonSnapdragon 1200 Wearable Platform–CNA
SnapdragonSnapdragon Wear 1300 Platform–CNA
SnapdragonSnapdragon X5 LTE Modem–CNA
SnapdragonWCD9306–CNA
SnapdragonWCD9330–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refqualcomm.com/company/product-security/bulletins/april-2023-bulletin