Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 14, 2022 · Catalog

   Detected

   Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

2. Dec 5, 2023 · CISA KEV

   Known exploited

   Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

3. Dec 26, 2023 · CISA KEV

   Remediation due

   Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Affected

• cpe qualcomm/apq8053 firmwareversion unspecified
• cpe qualcomm/ar8031 firmwareversion unspecified
• cpe qualcomm/ar8035 firmwareversion unspecified
• cpe qualcomm/csra6620 firmwareversion unspecified
• cpe qualcomm/csra6640 firmwareversion unspecified
• cpe qualcomm/mdm9150 firmwareversion unspecified
• cpe qualcomm/msm8953 firmwareversion unspecified
• cpe qualcomm/qca6174a firmwareversion unspecified
• cpe qualcomm/qca6390 firmwareversion unspecified
• cpe qualcomm/qca6391 firmwareversion unspecified
• cpe qualcomm/qca6426 firmwareversion unspecified
• cpe qualcomm/qca6436 firmwareversion unspecified
• vendor Qualcomm Multiple Chipsetsversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2022-22071

  Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.

  cisa.gov
• CVE.orgVulnerability recordCVE-2022-22071

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2022-22071

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2022-22071

  Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &

  nvd.nist.gov

References

• CISA note · git.codelinaro.org
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Patch · qualcomm.com