by Kastro
Paper/Archive/CVE-2022-33288

CVE-2022-33288

Qualcomm, Inc. Snapdragon — Buffer copy without checking the size of input in Core

EPSS 0.1%CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 1.7.017 × 200.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonFlight RB5 5G Platform–CNA
SnapdragonQAM8295P–CNA
SnapdragonQCA6174A–CNA
SnapdragonQCA6310–CNA

Scores by source

qualcomm (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/april-2023-bulletin