Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, S

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• qualcomm apq8009w firmwareall versions
• qualcomm apq8096au firmwareall versions
• qualcomm aqt1000 firmwareall versions
• qualcomm ar8031 firmwareall versions
• qualcomm ar8035 firmwareall versions
• qualcomm csra6620 firmwareall versions
• qualcomm csra6640 firmwareall versions
• qualcomm fsm10055 firmwareall versions
• qualcomm fsm10056 firmwareall versions
• qualcomm mdm9150 firmwareall versions
• qualcomm mdm9650 firmwareall versions
• qualcomm msm8909w firmwareall versions
• qualcomm msm8996au firmwareall versions
• qualcomm qca6174a firmwareall versions
• qualcomm qca6390 firmwareall versions
• qualcomm qca6391 firmwareall versions
• qualcomm qca6420 firmwareall versions
• qualcomm qca6421 firmwareall versions
• qualcomm qca6426 firmwareall versions
• qualcomm qca6430 firmwareall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (qualcomm). Independent of NVD's CPE analysis and usually ahead of it.

• Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  • APQ8009W, APQ8096AU, AQT1000, AR8031, AR8035, CSRA6620, CSRA6640, FSM10055, FSM10056, MDM9150, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6390, QCA6391, QCA6420, QCA6421, QCA6426, QCA6430, QCA6431, QCaffected

Other highest-scoring records for the same primary product.

• CVE-2022-22086Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Sn
  39Monitor
• CVE-2021-35104Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdr
  39Monitor
• CVE-2021-30341Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn
  39Monitor
• CVE-2021-35068Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapd
  39Monitor
• CVE-2020-11307Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect
  39Monitor
• CVE-2020-11168u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond its range' in Snapdr
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.