high8.4Known exploited
CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-12-05. Federal due date: 2023-12-26.
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Impact
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qualcomm | Apq8053 Firmware | All versions |
| Qualcomm | Ar8031 Firmware | All versions |
| Qualcomm | Ar8035 Firmware | All versions |
| Qualcomm | Csra6620 Firmware | All versions |
| Qualcomm | Csra6640 Firmware | All versions |
| Qualcomm | Mdm9150 Firmware | All versions |
| Qualcomm | Msm8953 Firmware | All versions |
| Qualcomm | Qca6174a Firmware | All versions |
| Qualcomm | Qca6390 Firmware | All versions |
| Qualcomm | Qca6391 Firmware | All versions |
| Qualcomm | Qca6426 Firmware | All versions |
| Qualcomm | Qca6436 Firmware | All versions |