CVE-2022-33255 Buffer over-read in Bluetooth HOST
A buffer over-read in the Bluetooth HOST allows a peer device to disclose sensitive information from memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33255?
CVE-2022-33255 is a high-severity vulnerability in Qualcomm Apq8009 Firmware, published on 6 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Which versions are affected by CVE-2022-33255?
It affects 92 products.
Products include Qualcomm Apq8009 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Msm8108 Firmware, Qualcomm Msm8208 Firmware and 86 more.
How do I fix CVE-2022-33255?
Apply the vendor's patch.
Is CVE-2022-33255 being exploited?
There is no known exploitation of CVE-2022-33255 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8009 Firmware
- CVE-2021-1905 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2020-11261 Qualcomm Multiple Chipsets Improper Input Validation
- CVE-2021-1906 Qualcomm Multiple Chipsets Detection of Error Condition Without Action
- CVE-2022-40510 Buffer copy without checking size of input in Audio.
- CVE-2022-22088 Integer Overflow to Buffer Overflow in Bluetooth HOST
Sources
Also known as 3212699, A-250627529, ASB-A-250627529, GHSA-gc9c-5cvm-jfhx.