CVE-2022-33216 Improper Input Validation in Automotive
Attackers can cause a transient denial of service in Qualcomm Snapdragon automotive systems by providing malformed ELF files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33216?
CVE-2022-33216 is a medium-severity denial of service vulnerability in Qualcomm Qam8295p Firmware, published on 9 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.
Weakness: CWE-20
Which versions are affected by CVE-2022-33216?
It affects 18 products.
Products include Qualcomm Qam8295p Firmware, Qualcomm Qca6574a Firmware, Qualcomm Qca6574au Firmware, Qualcomm Qca6595 Firmware, Qualcomm Qca6595au Firmware, Qualcomm Qca6696 Firmware and 12 more.
How do I fix CVE-2022-33216?
No fix has been published for CVE-2022-33216 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33216 being exploited?
There is no known exploitation of CVE-2022-33216 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qam8295p Firmware
- CVE-2023-33039 Use After Free in Automotive Display
- CVE-2023-21642 Improper Access Control in HAB Memory Management
- CVE-2022-40539 Improper Validation of Array Index in Automotive Android OS
- CVE-2022-33274 Improper validation of array index in Android Core
- CVE-2022-33300 Improper input validation in Automotive Android OS
Sources
Also known as GHSA-89gg-r749-m2mc.