CVE-2022-33211 : memory corruption in modem due to improper check while calculating size of seria

memory corruption in modem due to improper check while calculating size of serialized CoAP message

Published 2023-04-13 07:15:14

Updated 2024-04-12 17:15:59

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionInput validation

Products affected by CVE-2022-33211

Qualcomm » Mdm9206 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9206 » Version: N/A
Qualcomm » Mdm9205 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9205_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9205 » Version: N/A
Qualcomm » Wcd9330 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9330 » Version: N/A
Qualcomm » Mdm8207 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm8207_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm8207 » Version: N/A
Qualcomm » Mdm9207 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9207_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9207 » Version: N/A
Qualcomm » Qca4004 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4004_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4004 » Version: N/A
Qualcomm » Wcd9306 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9306_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9306 » Version: N/A
Qualcomm » Qts110 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qts110_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qts110 » Version: N/A
Qualcomm » Snapdragon Wear 1100 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1100_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1100 » Version: N/A
Qualcomm » Snapdragon Wear 1200 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1200_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1200 » Version: N/A
Qualcomm » Snapdragon Wear 1300 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1300 » Version: N/A
Qualcomm » Snapdragon X5 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_x5_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon X5 Lte Modem » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-33211

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-33211

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	Qualcomm, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-33211

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: product-security@qualcomm.com (Secondary)
CWE-131 Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-33211

https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin

Security Bulletins | Qualcomm Documentation
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-33211

Products affected by CVE-2022-33211

Exploit prediction scoring system (EPSS) score for CVE-2022-33211

CVSS scores for CVE-2022-33211

CWE ids for CVE-2022-33211

References for CVE-2022-33211