CVE-2022-33301: Incorrect type conversion or cast in Audio
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/vendor/qcom/opensource/agmto a version that resolves this vulnerability.Fixed in SoCVersion:2023-04-05
Event History
Frequently Asked Questions
What level of access does an attacker need?
The severity vector specifies local attack access and high privileges. Exploitation also involves sending a crafted address through AGM IPC to AGM during audio playback or capture.
Which firmware products are listed as affected?
The listed products are Qualcomm Qca6595 Firmware, Qca6595au Firmware, Qca6696 Firmware, Sa6150p Firmware, Sa6155p Firmware, Sa8145p Firmware, Sa8150p Firmware, and Sa8155p Firmware.
What is the potential security impact if exploitation succeeds?
The supplied severity vector rates confidentiality, integrity, and availability impact as high. The vector indicates the scope is unchanged.