CVE-2022-22063 - Vulnerability Details - OpenCVE

Memory corruption in Core due to improper configuration in boot remapper.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Qualcomm	Apq8096au Apq8096au Firmware Mdm9640 Mdm9640 Firmware Mdm9645 Mdm9645 Firmware Qca6174 Qca6174 Firmware Qca6174a Qca6174a Firmware Qca6574a Qca6574a Firmware Qca6574au Qca6574au Firmware Wcn3990 Wcn3990 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:qualcomm:mdm9645_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:mdm9645:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:qualcomm:qca6174_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:qca6174:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin

History

Fri, 18 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2022-12-14T05:54:11.389Z

Updated: 2025-04-18T14:35:56.916Z

Reserved: 2021-12-21T09:16:35.465Z

Link: CVE-2022-22063

Vulnrichment

Updated: 2024-08-03T03:00:55.211Z

NVD

Status : Modified

Published: 2022-12-15T19:15:16.507

Modified: 2024-11-21T06:46:01.793

Link: CVE-2022-22063

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-22063", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "requesterUserId": "fce08686-75c8-492d-867f-46232ff5c6d5", "dateReserved": "2021-12-21T09:16:35.465Z", "datePublished": "2022-12-14T05:54:11.389Z", "dateUpdated": "2025-04-18T14:35:56.916Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon Auto", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "APQ8096AU"}, {"status": "affected", "version": "MDM9640"}, {"status": "affected", "version": "MDM9645"}, {"status": "affected", "version": "QCA6174"}, {"status": "affected", "version": "QCA6174A"}, {"status": "affected", "version": "QCA6574A"}, {"status": "affected", "version": "QCA6574AU"}, {"status": "affected", "version": "WCN3990"}]}], "descriptions": [{"lang": "en", "value": "Memory corruption in Core due to improper configuration in boot remapper."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2022-12-15T03:44:03.964Z"}, "references": [{"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"}], "title": "Memory corruption in Core", "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:00:55.211Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-18T14:34:23.206429Z", "id": "CVE-2022-22063", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T14:35:56.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:00:55.211Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-22063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-18T14:34:23.206429Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T14:34:58.205Z"}}], "cna": {"title": "Memory corruption in Core", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "APQ8096AU"}, {"status": "affected", "version": "MDM9640"}, {"status": "affected", "version": "MDM9645"}, {"status": "affected", "version": "QCA6174"}, {"status": "affected", "version": "QCA6174A"}, {"status": "affected", "version": "QCA6574A"}, {"status": "affected", "version": "QCA6574AU"}, {"status": "affected", "version": "WCN3990"}], "platforms": ["Snapdragon Auto", "Snapdragon Consumer IOT", "Snapdragon Industrial IOT", "Snapdragon Mobile"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"}], "descriptions": [{"lang": "en", "value": "Memory corruption in Core due to improper configuration in boot remapper."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2022-12-15T03:44:03.964Z"}}}, "cveMetadata": {"cveId": "CVE-2022-22063", "state": "PUBLISHED", "dateUpdated": "2025-04-18T14:35:56.916Z", "dateReserved": "2021-12-21T09:16:35.465Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2022-12-14T05:54:11.389Z", "requesterUserId": "fce08686-75c8-492d-867f-46232ff5c6d5", "assignerShortName": "qualcomm"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD17C0A3-A200-4659-968B-B2DA03CB683F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:apq8096au:-:*:*:*:*:*:*:*", "matchCriteriaId": "B1F31FFB-982A-4308-82F8-C2480DABDED8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "7FD1C359-C79B-4CE8-A192-5AA34D0BF05B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:*", "matchCriteriaId": "716B747E-672C-4B95-9D8E-1262338E67EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:mdm9645_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "65E5C59A-ABCF-4F62-8C6D-ECDACDAA83C9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:mdm9645:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F8F856B-70D7-4A1A-8257-90AAAE62CD6F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qca6174_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D0814A50-D8E6-42BD-A0A3-0768A3E28F53", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qca6174:-:*:*:*:*:*:*:*", "matchCriteriaId": "D2AD8F5C-1FEB-45C2-BC8F-123C2BEB0EA5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "4FF653D0-15CF-4A10-8D8E-BE56F4DAB890", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*", "matchCriteriaId": "C31FA74C-6659-4457-BC32-257624F43C66", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "828CFB37-76A6-4927-9D00-AF9A1C432DD6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*", "matchCriteriaId": "11405993-5903-4716-B452-370281034B42", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D527E2B1-2A46-4FBA-9F7A-F5543677C8FB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*", "matchCriteriaId": "8374DDB3-D484-4141-AE0C-42333D2721F6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2744A053-5BD9-45A9-A2FC-791BCA0CCD4C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5F28E29-520F-469E-B048-62DE2EF07ADD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory corruption in Core due to improper configuration in boot remapper."}, {"lang": "es", "value": "Corrupci\u00f3n de la memoria en Core debido a una configuraci\u00f3n incorrecta en el reasignador de arranque."}], "id": "CVE-2022-22063", "lastModified": "2024-11-21T06:46:01.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "product-security@qualcomm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-15T19:15:16.507", "references": [{"source": "product-security@qualcomm.com", "tags": ["Vendor Advisory"], "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"}], "sourceIdentifier": "product-security@qualcomm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}