CVE-2022-33259 : Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.

Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.

Published 2023-04-13 07:15:16

Updated 2024-04-12 17:16:14

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowMemory Corruption

Exploit prediction scoring system (EPSS) score for CVE-2022-33259

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-33259

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	Qualcomm, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-33259

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by:

nvd@nist.gov (Primary)
product-security@qualcomm.com (Secondary)

Products affected by CVE-2022-33259

Qualcomm » Mdm9206 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9206 » Version: N/A
Qualcomm » Mdm9205 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9205_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9205 » Version: N/A
Qualcomm » Wcd9330 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9330 » Version: N/A
Qualcomm » Mdm8207 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm8207_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm8207 » Version: N/A
Qualcomm » Mdm9207 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9207_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9207 » Version: N/A
Qualcomm » Qca4004 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4004_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4004 » Version: N/A
Qualcomm » Wcd9306 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9306_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9306 » Version: N/A
Qualcomm » Qts110 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qts110_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qts110 » Version: N/A
Qualcomm » Snapdragon Wear 1100 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1100_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1100 » Version: N/A
Qualcomm » Snapdragon Wear 1200 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1200_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1200 » Version: N/A
Qualcomm » Snapdragon Wear 1300 Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1300 » Version: N/A
Qualcomm » Snapdragon X5 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_x5_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon X5 Lte Modem » Version: N/A

Vulnerability Details : CVE-2022-33259

Exploit prediction scoring system (EPSS) score for CVE-2022-33259

CVSS scores for CVE-2022-33259

CWE ids for CVE-2022-33259

References for CVE-2022-33259

Products affected by CVE-2022-33259