CVE-2022-22071: high-severity vulnerability in Qualcomm, Inc. Snapdragon Auto, Snapdragon…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
A memory management flaw allows attackers to access or manipulate freed memory while a process is initializing, potentially leading to system crashes or code execution on Snapdragon devices.
Use-after-free vulnerability in process shell memory deallocation via IOCTL munmap during process initialization. Attack vector requires local access to trigger the race condition between memory freeing and ongoing process setup, enabling arbitrary memory access with HIGH severity impact across multiple Snapdragon platforms.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.