CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Description
CVE-2022-22071 is a high-severity use-after-free vulnerability in Qualcomm chipset firmware across Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, and Voice & Music product lines, with a CVSS 3.1 score of 8.4. The flaw occurs when a process’s shell memory is freed via an IOCTL munmap call while process initialization is simultaneously in progress, creating a race condition that can result in a dangling pointer being used after the memory has been freed (CWE-416). A local attacker without any privileges can exploit this condition to achieve arbitrary code execution, data disclosure, and system instability. The vulnerability was patched in Qualcomm’s May 2022 Security Bulletin and has been added to CISA’s Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| qualcomm | apq8053 firmware | - |
| qualcomm | ar8031 firmware | - |
| qualcomm | ar8035 firmware | - |
| qualcomm | csra6620 firmware | - |
| qualcomm | csra6640 firmware | - |
| qualcomm | mdm9150 firmware | - |
| qualcomm | msm8953 firmware | - |
| qualcomm | qca6174a firmware | - |
| qualcomm | qca6390 firmware | - |
| qualcomm | qca6391 firmware | - |
| qualcomm | qca6426 firmware | - |
| qualcomm | qca6436 firmware | - |
| qualcomm | qca6574 firmware | - |
| qualcomm | qca6574a firmware | - |
| qualcomm | qca6574au firmware | - |
| qualcomm | qca6595au firmware | - |
| qualcomm | qca6696 firmware | - |
| qualcomm | qca8081 firmware | - |
| qualcomm | qca8337 firmware | - |
| qualcomm | qca9377 firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22071(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a memory safety vulnerability where a program continues to reference a memory region after it has been freed. The consequence depends on how the freed memory is subsequently reallocated and used, but in kernel-level code, it typically enables privilege escalation or arbitrary code execution.
In CVE-2022-22071, the use-after-free condition is introduced by a time-of-check/time-of-use (TOCTOU) race condition: process shell memory is freed via an IOCTL munmap call while the process initialization routine is concurrently running and still holds a reference to that memory. If the freed memory is reallocated by another kernel component before the initialization routine finishes using it, an attacker can potentially control the reallocated content and redirect execution flow or corrupt critical kernel structures. The absence of proper synchronization between the munmap operation and the process initialization path is the root cause of this weakness.
Impact Analysis
CVE-2022-22071 is rated High with a CVSS score of 8.4. The attack requires local access (AV:L) but no privileges (PR:N) and no user interaction (UI:N), making it easily exploitable by any local process or malicious application on an affected device.
Confidentiality Impact (High): A successful exploit can expose kernel memory, user data, and potentially cryptographic secrets processed on the device.
Integrity Impact (High): By controlling freed and reallocated kernel memory, an attacker can corrupt kernel data structures, redirect execution, or implant persistent malicious code.
Availability Impact (High): The race condition may also trigger kernel panics or system crashes, disrupting device availability.
The vulnerability affects an exceptionally broad range of Qualcomm chipsets — spanning mobile phones, IoT devices, automotive systems, and audio/voice platforms — significantly expanding the potential attack surface. CISA’s KEV listing confirms that this vulnerability has been weaponized in real-world attacks.
Exploit Maturity
CVE-2022-22071 is confirmed as actively exploited and is included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of December 26, 2023. The EPSS score of approximately 0.00552 (67.6th percentile) indicates a moderate-to-elevated probability of exploitation relative to other published CVEs. The no-privilege-required local attack vector is particularly attractive for exploitation via malicious Android applications or privilege escalation chains. Qualcomm use-after-free vulnerabilities of this class have historically been exploited by commercial spyware toolkits and nation-state actors.
Remediation
- Apply Qualcomm’s May 2022 Security Bulletin patches: Install firmware updates from your device manufacturer that include Qualcomm’s fix for CVE-2022-22071. Reference: Qualcomm May 2022 Security Bulletin.
- Comply with CISA KEV requirements: Ensure all affected devices are patched no later than December 26, 2023. Discontinue use of devices that cannot be updated.
- Deploy OEM firmware updates promptly: Since Qualcomm chipset patches are delivered through device manufacturer (OEM) firmware updates, monitor your device vendor’s security advisory channels for relevant updates.
- Enforce least-privilege app controls: Restrict the installation of untrusted applications, particularly those requesting broad system permissions, to minimize exploitation risk.
- Prioritize high-risk devices: Devices used by sensitive personnel or with access to critical organizational data should receive patching priority.
- Implement mobile threat defense (MTD): Deploy mobile threat detection solutions capable of identifying kernel exploitation attempts, privilege escalation behavior, or anomalous memory operations on affected devices.
Technical Details
CVE-2022-22071 is a Use After Free (CWE-416) vulnerability introduced by a race condition between two concurrent kernel operations in Qualcomm’s chipset firmware.
The vulnerability arises in the kernel’s process management code during the following sequence:
- A user-space process initiates an IOCTL munmap call to free a region of shell memory associated with the process.
- Concurrently, the same process’s initialization routine is still running and holds a reference to the same memory region.
- Due to insufficient synchronization, the kernel frees the memory in response to the munmap call while the initialization routine continues to use a now-dangling pointer to the freed region.
This creates a classic time-of-check/time-of-use race window. An attacker who can control the timing of these operations — or who can win the race by manipulating system load or scheduling — can trigger the use-after-free condition. If the freed memory is subsequently reallocated with attacker-controlled content before the dangling pointer is dereferenced, the attacker gains the ability to control code execution or corrupt kernel state.
The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that no privileges are required, attack complexity is rated Low (despite the race condition, it is reliably triggerable with known techniques), and full system compromise is achievable. The unchanged scope means impact is confined to the affected kernel security boundary, but total kernel compromise is the maximum possible impact within that boundary.
Frequently Asked Questions
What is a use-after-free vulnerability and how does it lead to exploitation?
A use-after-free occurs when a program frees a memory region but continues to hold a reference (pointer) to it. After the memory is freed, the allocator may reuse it for a different purpose. An attacker can exploit this by arranging for the freed memory to be reallocated with attacker-controlled content before the stale pointer is dereferenced, allowing them to influence program execution or corrupt critical data structures.
Why does the CVSS score show Low Attack Complexity if there is a race condition?
The CVSS Attack Complexity metric reflects the conditions an attacker can control, not the inherent technical difficulty. Race conditions of this type in kernel IOCTL paths have well-established exploitation techniques that reliably win the race window, particularly on multi-core systems where concurrent execution can be carefully orchestrated. CVSS AC:L indicates that no special circumstances beyond the attacker’s control are needed.
Which Qualcomm product lines are affected by CVE-2022-22071?
The affected product lines include Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile, and Snapdragon Voice & Music. Specific affected chipsets are listed in the Qualcomm May 2022 Security Bulletin.
How does CVE-2022-22071 differ from CVE-2023-33063, which is also a Qualcomm use-after-free?
Both are use-after-free vulnerabilities in Qualcomm firmware, but they affect different subsystems and code paths. CVE-2022-22071 involves a race condition between a munmap IOCTL call and process initialization in process memory management code, while CVE-2023-33063 involves improper memory lifecycle management during HLOS-to-DSP remote procedure calls in the DSP Services layer. They were disclosed and patched in separate Qualcomm security bulletins (May 2022 vs. December 2023).
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.