CVE-2022-33301 Incorrect type conversion or cast in Audio
Memory corruption in Qualcomm audio subsystem allows code execution via crafted IPC messages, affecting Android devices using Snapdragon chips.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33301?
CVE-2022-33301 is a medium-severity memory corruption vulnerability in Qualcomm Qca6595 Firmware, published on 4 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Weakness: CWE-704
Which versions are affected by CVE-2022-33301?
It affects 16 products.
Products include Qualcomm Qca6595 Firmware, Qualcomm Qca6595au Firmware, Qualcomm Qca6696 Firmware, Qualcomm Sa6150p Firmware, Qualcomm Sa6155p Firmware, Qualcomm Sa8145p Firmware and 10 more.
How do I fix CVE-2022-33301?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-33301 being exploited?
There is no known exploitation of CVE-2022-33301 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Qca6595 Firmware
Sources
Also known as 3230723, A-250649259, GHSA-hv4g-mmv9-qwrp, PUB-A-250649259.