{"id":"CVE-2022-22071","kind":"vulnerability","aliases":["CVE-2022-22071"],"related":[],"title":"Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in…","description":"Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.\n\nCISA required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","summary":"Multiple Qualcomm chipsets have a use-after-free bug when process shell memory is freed through an IOCTL munmap call while process initialization is still running. A local attacker can use it to corrupt memory and likely gain elevated privileges on the device.","severity":"high","cvss":8.4,"epss":null,"exploited":true,"exploited_at":"2023-12-05T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm apq8053 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8031 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm ar8035 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6620 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm csra6640 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm mdm9150 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm msm8953 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6174a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6390 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6391 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6426 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6436 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574a firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6574au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6595au firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca6696 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca8081 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca8337 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qca9377 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm2290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm4290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcm6490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs2290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs405 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs410 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs4290 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs610 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qcs6490 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qrb5165 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qrb5165m firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qrb5165n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm qualcomm215 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa6155p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8155p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sa8195p firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd439 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd460 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd480 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"qualcomm sd662 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","qualcomm"],"not_affected_if":["unpatched-vendor-update-applied"],"how_to_check":null,"fix":"Apply the vendor remediation from Qualcomm's security bulletin or the device maker's update; if none is available, discontinue use of the affected product per CISA.","status":"open","published_at":"2022-06-14T10:15:19+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:42+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:02:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor remediation from Qualcomm's security bulletin or the device maker's update; if none is available, discontinue use of the affected product per CISA.","reach":"local","impact":"high","summary":"Multiple Qualcomm chipsets have a use-after-free bug when process shell memory is freed through an IOCTL munmap call while process initialization is still running. A local attacker can use it to corrupt memory and likely gain elevated privileges on the device.","category":"infrastructure","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.5,"needs_auth":"yes","worst_case":"local code gains kernel-level control of the device","analyst_note":"Find the affected chipset list and patched firmware/bulletin for CVE-2022-22071 at Qualcomm's bulletin page; the sources do not name models or versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-vendor-update-applied"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000472,"input_tokens":2843,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':19A,22A '-22071':20A,23A 'action':226C 'android':147B 'appli':227C 'apq8053':28A 'ar8031':31A 'ar8035':34A 'attack':183B 'bug':163B 'call':14A,174B,217C 'chipset':156B,200C 'chipsets':26A 'cisa':224C 'contain':201C 'corrupt':188B 'csra6620':37A 'csra6640':40A 'cve':18A,21A 'devic':152B,197B 'discontinu':235C 'elev':193B 'exploit':148B 'firmware':29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,104A,107A,110A,113A,116A,119A,122A,125A,128A,131A,134A,137A,140A,143A,146A 'free':4A,162B,206C 'freed':10A,169B,213C 'gain':192B 'infrastructur':149B 'initi':17A,177B,220C 'instruct':233C 'ioctl':12A,172B,215C 'like':191B 'local':182B 'mdm9150':43A 'memori':8A,167B,189B,211C 'mitig':230C,243C 'mobil':151B 'mobile-devic':150B 'msm8953':46A 'multipl':154B,198C 'multiple':25A 'munmap':13A,173B,216C 'per':231C 'possibl':1A 'privileg':194B 'process':6A,16A,165B,176B,209C,219C 'product':239C 'progress':223C 'qca6174a':49A 'qca6390':52A 'qca6391':55A 'qca6426':58A 'qca6436':61A 'qca6574':64A 'qca6574a':67A 'qca6574au':70A 'qca6595au':73A 'qca6696':76A 'qca8081':79A 'qca8337':82A 'qca9377':85A 'qcm2290':88A 'qcm4290':91A 'qcm6490':94A 'qcs2290':97A 'qcs405':100A 'qcs410':103A 'qcs4290':106A 'qcs610':109A 'qcs6490':112A 'qrb5165':115A 'qrb5165m':118A 'qrb5165n':121A 'qualcomm':24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,102A,105A,108A,111A,114A,117A,120A,123A,126A,129A,132A,135A,138A,141A,144A,153B,155B,199C 'qualcomm215':124A 'remedi':228C,241C 'requir':225C 'run':180B 'sa6155p':127A 'sa8155p':130A 'sa8195p':133A 'sd439':136A 'sd460':139A 'sd480':142A 'sd662':145A 'shell':7A,166B,210C 'still':179B 'unavail':245C 'use':2A,11A,160B,185B,204C,214C,236C 'use-after-fre':159B,203C 'vendor':232C 'vulner':207C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-06-14T10:15:19+00:00","kev":{"dateAdded":"2023-12-05","dueDate":"2023-12-26","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22071","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22071","severity":null,"published_at":"2023-12-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22071","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22071","severity":null,"published_at":"2022-06-14T10:15:19+00:00","modified_at":"2026-06-17T04:27:37+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}