Wcd9335 Firmware Security Vulnerabilities - February 2023

CVE-2022-25728

Information disclosure in modem due to buffer over-read while processing response from DNS server

CVE-2022-25729

Memory corruption in modem due to improper length check while copying into memory

CVE-2022-25732

Information disclosure in modem due to buffer over read in dns client due to missing length check

CVE-2022-25733

Denial of service in modem due to null pointer dereference while processing DNS packets

CVE-2022-25734

Denial of service in modem due to missing null check while processing IP packets with padding

CVE-2022-25735

Denial of service in modem due to missing null check while processing TCP or UDP packets from server

CVE-2022-25738

Information disclosure in modem due to buffer over-red while performing checksum of packet received

CVE-2022-33229

Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.

CVE-2022-33233

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

CVE-2022-33243

Memory corruption due to improper access control in Qualcomm IPC.

CVE-2022-33248

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

CVE-2022-33271

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

CVE-2022-33277

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

CVE-2022-33280

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.

CVE-2022-33306

Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.

CVE-2022-40512

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

CVE-2022-40514

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.