CVE-2022-25750 : Memory corruption in BTHOST due to double free while music playback and calls ov

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Published 2022-10-19 11:15:11

Updated 2022-10-20 21:09:27

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2022-25750

Qualcomm » Wcn6855 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6855 » Version: N/A
Qualcomm » Wcn6856 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn6856 » Version: N/A
Qualcomm » Wcd9380 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9380 » Version: N/A
Qualcomm » Wcd9385 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9385 » Version: N/A
Qualcomm » Wcn7850 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn7850 » Version: N/A
Qualcomm » Wcn7851 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn7851 » Version: N/A
Qualcomm » Kailua Firmware » Version: N/A
cpe:2.3:o:qualcomm:kailua_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Kailua » Version: N/A
Qualcomm » Sg8275 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sg8275_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sg8275 » Version: N/A
Qualcomm » Sg8275p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sg8275p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sg8275p » Version: N/A
Qualcomm » Sm8550 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sm8550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sm8550 » Version: N/A
Qualcomm » Wcd9390 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9390 » Version: N/A
Qualcomm » Wcd9395 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9395 » Version: N/A
Qualcomm » Wsa8840 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8840 » Version: N/A
Qualcomm » Wsa8845 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8845 » Version: N/A
Qualcomm » Wsa8845h Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8845h » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-25750

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 15 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-25750

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	Qualcomm, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-25750

CWE-415 Double Free

The product calls free() twice on the same memory address.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-25750

https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin

Qualcomm Documentation
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-25750

Products affected by CVE-2022-25750

Exploit prediction scoring system (EPSS) score for CVE-2022-25750

CVSS scores for CVE-2022-25750

CWE ids for CVE-2022-25750

References for CVE-2022-25750