PT-2022-6727 · Google+1 · Android+1

Published 2022-06-14 · Updated 2024-04-12 · CVE-2022-33227

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions (affected versions not specified) Qualcomm embedded platform versions (affected versions not specified)

Description The issue is related to a memory corruption problem in the GPS HLOS driver of Android operating systems on Qualcomm embedded platforms. This problem occurs due to a double free error when calling the unregister provider after a register call. The exploitation of this issue could allow an attacker to cause a denial of service.

Recommendations For Android, update to a version that includes the fix for the memory corruption issue, if available. For Qualcomm embedded platforms, apply the necessary patches or updates to resolve the memory corruption problem, if available. As a temporary workaround, consider restricting access to the GPS HLOS driver to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Double Free

Weakness Enumeration

CWE-119

CWE-415

Related Identifiers

BDU:2023-03756

CVE-2022-33227

Affected Products

Android

Qualcomm Embedded Platform

References · 7

• https://bdu.fstec.ru/vul/2023-03756 · Security Note
• https://qualcomm.com/company/product-security/bulletins/june-2023-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33227 · Security Note
• https://t.me/cvenotify/51851 · Telegram Post
• https://vuldb.com/ru/?id.230771 · Note
• https://source.android.com/docs/security/bulletin/pixel/2023-06-01 · Note
• https://tenable.com/cve/CVE-2022-33227 · Note