CVE-2022-33302 — Improper Validation of Array Index in INC Snapdragon

CWE-129 — Improper Validation of Array Index3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 85.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qualcomm INC SnapdragonGoogle Android
Timeline
PublishedApr 13

Description

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5qualcomm_inc/snapdragon224 versions+223

🔴Vulnerability Details

1
GHSA
GHSA-3rwq-2648-vg59: Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length↗2023-04-13
▶

📋Vendor Advisories

1
Android
CVE-2022-33302: Closed-source component↗2023-04-01
▶