Details of VAR-202209-0271

ID

VAR-202209-0271

CVE

CVE-2022-22095

TITLE

Use of freed memory vulnerability in multiple Qualcomm products

Trust: 0.8

sources: JVNDB: JVNDB-2022-017303

DESCRIPTION

Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile. APQ8053 firmware, MSM8953 firmware, QCA6390 Multiple Qualcomm products, such as firmware, contain vulnerabilities related to use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2022-22095 // JVNDB: JVNDB-2022-017303 // VULMON: CVE-2022-22095

AFFECTED PRODUCTS

vendor:	qualcomm	model:	wcd9370	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn6850	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd765g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8953	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6391	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd662	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd855	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs2290	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd680	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd439	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3998	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8835	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8810	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9385	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9375	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm7250p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9380	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3680b	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3615	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3950	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn6851	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd765	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcm2290	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd460	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6426	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qrb5165	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd865 5g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx55m	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8815	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd690 5g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3991	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdxr2 5g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qrb5165n	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcm4290	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3988	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3910	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qrb5165m	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd750g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6436	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm4125	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6390	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd870	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9341	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx55	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9326	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd768g	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8830	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs4290	scope:	eq	version:	-	Trust: 1.0
vendor:	クアルコム	model:	qca6391	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8053	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd690 5g	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd662	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6436	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qcs4290	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qcm4290	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd460	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6390	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qrb5165m	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qrb5165	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6426	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qcm2290	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qrb5165n	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd750g	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qcs2290	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd439	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd680	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	msm8953	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	sd765	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-017303 // NVD: CVE-2022-22095

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-22095
value:	HIGH
Trust: 1.0
product-security@qualcomm.com:	CVE-2022-22095
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-22095
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202209-241
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-22095
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
product-security@qualcomm.com:	CVE-2022-22095
baseSeverity:	HIGH
baseScore:	8.4
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.5
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2022-22095
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-017303 // CNNVD: CNNVD-202209-241 // NVD: CVE-2022-22095 // NVD: CVE-2022-22095

PROBLEMTYPE DATA

problemtype:	CWE-416	Trust: 1.0
problemtype:	Use of freed memory (CWE-416) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-017303 // NVD: CVE-2022-22095

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202209-241

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202209-241

EXTERNAL IDS

db:	NVD	id:	CVE-2022-22095	Trust: 3.3
db:	JVNDB	id:	JVNDB-2022-017303	Trust: 0.8
db:	AUSCERT	id:	ESB-2022.4460	Trust: 0.6
db:	CNNVD	id:	CNNVD-202209-241	Trust: 0.6
db:	VULMON	id:	CVE-2022-22095	Trust: 0.1

sources: VULMON: CVE-2022-22095 // JVNDB: JVNDB-2022-017303 // CNNVD: CNNVD-202209-241 // NVD: CVE-2022-22095

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-22095	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2022.4460	Trust: 0.6
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-september-2022-39200	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-22095/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2022-22095 // JVNDB: JVNDB-2022-017303 // CNNVD: CNNVD-202209-241 // NVD: CVE-2022-22095

SOURCES

db:	VULMON	id:	CVE-2022-22095
db:	JVNDB	id:	JVNDB-2022-017303
db:	CNNVD	id:	CNNVD-202209-241
db:	NVD	id:	CVE-2022-22095

LAST UPDATE DATE

2024-08-14T13:02:16.022000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-22095	date:	2022-09-16T00:00:00
db:	JVNDB	id:	JVNDB-2022-017303	date:	2023-10-12T05:01:00
db:	CNNVD	id:	CNNVD-202209-241	date:	2022-09-21T00:00:00
db:	NVD	id:	CVE-2022-22095	date:	2022-09-20T13:15:51.917

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-22095	date:	2022-09-16T00:00:00
db:	JVNDB	id:	JVNDB-2022-017303	date:	2023-10-12T00:00:00
db:	CNNVD	id:	CNNVD-202209-241	date:	2022-09-06T00:00:00
db:	NVD	id:	CVE-2022-22095	date:	2022-09-16T06:15:10.423