PT-2021-7409 · Qualcomm · Qualcomm Snapdragon Compute+7

Published 2021-07-26 · Updated 2023-04-19 · CVE-2022-25688

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions (affected versions not specified) Qualcomm Snapdragon Compute versions (affected versions not specified) Qualcomm Snapdragon Connectivity versions (affected versions not specified) Qualcomm Snapdragon Consumer IOT versions (affected versions not specified) Qualcomm Snapdragon Industrial IOT versions (affected versions not specified) Qualcomm Snapdragon Mobile versions (affected versions not specified) Qualcomm Snapdragon Voice & Music versions (affected versions not specified) Qualcomm Snapdragon Wearables versions (affected versions not specified)

Description The issue is related to a buffer overflow in the video component of Qualcomm's embedded software when handling .ps video files. This can be exploited by a remote attacker to cause a denial of service or execute arbitrary code. The vulnerability affects various Snapdragon products, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.

Recommendations For Qualcomm Snapdragon Auto, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Compute, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Connectivity, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Consumer IOT, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Industrial IOT, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Mobile, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Voice & Music, update to a version that includes the fix for the buffer overflow issue. For Qualcomm Snapdragon Wearables, update to a version that includes the fix for the buffer overflow issue. As a temporary workaround, consider disabling the video component when handling .ps files until a patch is available. Restrict access to the video parsing functionality to minimize the risk of exploitation. Avoid using the vulnerable video component in the affected Snapdragon products until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

BDU:2022-06020

CVE-2022-25688

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

Qualcomm Snapdragon Wearables

References · 8

• https://bdu.fstec.ru/vul/2022-06020 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25688 · Security Note
• https://qualcomm.com/company/product-security/bulletins/september-2022-bulletin · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2022-09-01 · Note
• https://t.me/cibsecurity/49892 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022090806 · Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html · Note
• https://t.me/cvenotify/36301 · Telegram Post