PT-2022-4878 · Qualcomm · Snapdragon Mobile+8

Published 2022-06-06 · Updated 2023-04-19 · CVE-2022-25690

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions (affected versions not specified) Snapdragon Auto versions (affected versions not specified) Snapdragon Compute versions (affected versions not specified) Snapdragon Connectivity versions (affected versions not specified) Snapdragon Consumer Electronics Connectivity versions (affected versions not specified) Snapdragon Consumer IOT versions (affected versions not specified) Snapdragon Industrial IOT versions (affected versions not specified) Snapdragon Mobile versions (affected versions not specified) Snapdragon Voice & Music versions (affected versions not specified)

Description The issue is related to the implementation of WLAN technology in Qualcomm's microprogrammable software for embedded boards, which is connected with unchecked array indexing when processing ANQP elements. This can be exploited by a remote attacker to gain unauthorized access to protected information by sending specially crafted packets. The vulnerability is due to improper validation of array index while parsing crafted ANQP action frames.

Recommendations For Qualcomm Snapdragon, consider disabling the ANQP functionality until a patch is available. For Snapdragon Auto, restrict access to the vulnerable ANQP module to minimize the risk of exploitation. For Snapdragon Compute, avoid using the ANQP action frames in the affected API endpoint until the issue is resolved. For Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, and Snapdragon Voice & Music, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

BDU:2022-06013

CVE-2022-25690

Affected Products

Qualcomm Snapdragon

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Electronics Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

References · 7

• https://bdu.fstec.ru/vul/2022-06013 · Security Note
• https://qualcomm.com/company/product-security/bulletins/september-2022-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25690 · Security Note
• https://source.android.com/docs/security/bulletin/2022-09-01 · Note
• https://t.me/cibsecurity/49869 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022090806 · Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html · Note