PT-2022-4879 · Qualcomm · Qualcomm Snapdragon Compute+5

Published 2022-03-02 · Updated 2023-04-19 · CVE-2022-25696

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto (affected versions not specified) Qualcomm Snapdragon Compute (affected versions not specified) Qualcomm Snapdragon Connectivity (affected versions not specified) Qualcomm Snapdragon Industrial IOT (affected versions not specified) Qualcomm Snapdragon Mobile (affected versions not specified) Qualcomm Snapdragon Wearables (affected versions not specified)

Description The issue is related to a time-of-check time-of-use race condition during map or unmap in the display component, which can lead to memory corruption. This can potentially allow an attacker to cause a denial of service or execute arbitrary code. The vulnerability is associated with synchronization errors when using a shared resource.

Recommendations For Qualcomm Snapdragon Auto, consider disabling the display component until a patch is available. For Qualcomm Snapdragon Compute, restrict access to the display module to minimize the risk of exploitation. For Qualcomm Snapdragon Connectivity, avoid using the vulnerable display function until the issue is resolved. For Qualcomm Snapdragon Industrial IOT, consider implementing additional synchronization mechanisms to prevent the time-of-check time-of-use race condition. For Qualcomm Snapdragon Mobile, restrict access to the display component to minimize the risk of exploitation. For Qualcomm Snapdragon Wearables, consider disabling the display component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2022-06015

CVE-2022-25696

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Wearables

References · 8

• https://qualcomm.com/company/product-security/bulletins/september-2022-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25696 · Security Note
• https://bdu.fstec.ru/vul/2022-06015 · Security Note
• https://t.me/cvenotify/36308 · Telegram Post
• https://t.me/cibsecurity/49879 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022090806 · Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html · Note
• https://source.android.com/docs/security/bulletin/2022-09-01 · Note