CVE-2022-33291 : Information disclosure in Modem due to buffer over-read while receiving a IP hea

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.

Published 2023-04-13 07:15:18

Updated 2024-04-12 17:16:24

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2022-33291

Qualcomm » Qca4010 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4010_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4010 » Version: N/A
Qualcomm » Wcd9335 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9335 » Version: N/A
Qualcomm » Wcn3998 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn3998 » Version: N/A
Qualcomm » Wsa8810 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8810 » Version: N/A
Qualcomm » Wsa8815 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8815 » Version: N/A
Qualcomm » Wcd9330 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9330_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9330 » Version: N/A
Qualcomm » Mdm8207 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm8207_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm8207 » Version: N/A
Qualcomm » Ar8031 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ar8031 » Version: N/A
Qualcomm » Csra6620 Firmware » Version: N/A
cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Csra6620 » Version: N/A
Qualcomm » Csra6640 Firmware » Version: N/A
cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Csra6640 » Version: N/A
Qualcomm » Qca4024 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4024_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4024 » Version: N/A
Qualcomm » Wcd9380 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9380 » Version: N/A
Qualcomm » Wcd9385 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9385 » Version: N/A
Qualcomm » Wcn3980 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn3980 » Version: N/A
Qualcomm » Wcn3999 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn3999 » Version: N/A
Qualcomm » Wsa8830 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8830 » Version: N/A
Qualcomm » Wsa8835 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8835 » Version: N/A
Qualcomm » Qca4004 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca4004_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca4004 » Version: N/A
Qualcomm » Wcd9306 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcd9306_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcd9306 » Version: N/A
Qualcomm » Wsa8832 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wsa8832 » Version: N/A
Qualcomm » Ssg2115p Firmware » Version: N/A
cpe:2.3:o:qualcomm:ssg2115p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ssg2115p » Version: N/A
Qualcomm » Ssg2125p Firmware » Version: N/A
cpe:2.3:o:qualcomm:ssg2125p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ssg2125p » Version: N/A
Qualcomm » Sxr1230p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sxr1230p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sxr1230p » Version: N/A
Qualcomm » Sxr2230p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sxr2230p » Version: N/A
Qualcomm » Qts110 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qts110_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qts110 » Version: N/A
Qualcomm » Snapdragon X5 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_x5_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon X5 Lte Modem » Version: N/A
Qualcomm » Wcn685x-1 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn685x-1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn685x-1 » Version: N/A
Qualcomm » Wcn785x-1 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn785x-1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn785x-1 » Version: N/A
Qualcomm » Snapdragon Ar2 Gen 1 Platform Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_ar2_gen_1_platform_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Ar2 Gen 1 Platform » Version: N/A
Qualcomm » Wcn685x-5 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn685x-5_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn685x-5 » Version: N/A
Qualcomm » Wcn785x-5 Firmware » Version: N/A
cpe:2.3:o:qualcomm:wcn785x-5_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Wcn785x-5 » Version: N/A
Qualcomm » 9205 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:9205_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » 9205 Lte Modem » Version: N/A
Qualcomm » 9206 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:9206_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » 9206 Lte Modem » Version: N/A
Qualcomm » 9207 Lte Modem Firmware » Version: N/A
cpe:2.3:o:qualcomm:9207_lte_modem_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » 9207 Lte Modem » Version: N/A
Qualcomm » Qcs400 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs400_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs400 » Version: N/A
Qualcomm » Snapdragon 1100 Wearable Platform Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_1100_wearable_platform_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon 1100 Wearable Platform » Version: N/A
Qualcomm » Snapdragon 1200 Wearable Platform Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_1200_wearable_platform_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon 1200 Wearable Platform » Version: N/A
Qualcomm » Snapdragon Wear 1300 Platform Firmware » Version: N/A
cpe:2.3:o:qualcomm:snapdragon_wear_1300_platform_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Snapdragon Wear 1300 Platform » Version: N/A
Qualcomm » Home Hub 100 Platform Firmware » Version: N/A
cpe:2.3:o:qualcomm:home_hub_100_platform_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Home Hub 100 Platform » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-33291

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-33291

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L	3.9	4.2	Qualcomm, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: Low

CWE ids for CVE-2022-33291

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)
CWE-126 Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Assigned by: product-security@qualcomm.com (Secondary)

References for CVE-2022-33291

https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin

Security Bulletins | Qualcomm Documentation
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-33291

Products affected by CVE-2022-33291

Exploit prediction scoring system (EPSS) score for CVE-2022-33291

CVSS scores for CVE-2022-33291

CWE ids for CVE-2022-33291

References for CVE-2022-33291