PT-2022-17445 · Qualcomm+1 · Qualcomm Snapdragon Compute+7

Seonung Jang

·

Published

2022-10-12

·

Updated

2025-05-15

·

CVE-2022-25664

CVSS v3.1

6.2

Medium

VectorAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto (affected versions not specified) Qualcomm Snapdragon Compute (affected versions not specified) Qualcomm Snapdragon Connectivity (affected versions not specified) Qualcomm Snapdragon Consumer IOT (affected versions not specified) Qualcomm Snapdragon Industrial IOT (affected versions not specified) Qualcomm Snapdragon Mobile (affected versions not specified) Qualcomm Snapdragon Wearables (affected versions not specified)
Description The issue is related to information disclosure due to exposure of information while the GPU reads the data. This can be used to leak large amounts of information to a malicious Android application. The vulnerability can leak information in both the user space and kernel space level of pages. The GitHub Security Lab used the kernel space information leak to construct a KASLR bypass.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2022-25664

Affected Products

Android
Qualcomm Snapdragon Auto
Qualcomm Snapdragon Compute
Qualcomm Snapdragon Connectivity
Qualcomm Snapdragon Consumer Iot
Qualcomm Snapdragon Industrial Iot
Qualcomm Snapdragon Mobile
Qualcomm Snapdragon Wearables