PT-2022-7006 · Qualcomm · Qualcomm Snapdragon Compute+6

Published 2022-06-14 · Updated 2025-04-02 · CVE-2022-22071

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions (affected versions not specified) Qualcomm Snapdragon Compute versions (affected versions not specified) Qualcomm Snapdragon Connectivity versions (affected versions not specified) Qualcomm Snapdragon Consumer IOT versions (affected versions not specified) Qualcomm Snapdragon Industrial IOT versions (affected versions not specified) Qualcomm Snapdragon Mobile versions (affected versions not specified) Qualcomm Snapdragon Voice & Music versions (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in Qualcomm's microprogrammed software, which can be exploited to impact the confidentiality, integrity, and availability of protected information. This can occur when process shell memory is freed using an IOCTL munmap call while process initialization is in progress.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-06342

CVE-2022-22071

Affected Products

Qualcomm Snapdragon Auto

Qualcomm Snapdragon Compute

Qualcomm Snapdragon Connectivity

Qualcomm Snapdragon Consumer Iot

Qualcomm Snapdragon Industrial Iot

Qualcomm Snapdragon Mobile

Qualcomm Snapdragon Voice & Music

References · 15

• https://qualcomm.com/company/product-security/bulletins/may-2022-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22071 · Security Note
• https://twitter.com/inthewildio/status/1709891068857086058 · Twitter Post
• https://twitter.com/fluidattacks/status/1735774984776130860 · Twitter Post
• https://cybersecurity-help.cz/blog/3537.html · Note
• https://xakep.ru/2023/10/04/qualcomm-0days · Note
• https://twitter.com/fletch_ai/status/1709389646830973191 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22071 · Note
• https://t.me/cvenotify/32001 · Telegram Post
• https://t.me/cvenotify/117459 · Telegram Post
• https://twitter.com/LindseyOD123/status/1709234811963883950 · Twitter Post
• https://t.me/true_secator/4924 · Telegram Post
• https://twitter.com/fletch_ai/status/1732657962093522947 · Twitter Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note