CVE-2022-33305
📋 TL;DR
This vulnerability allows attackers to cause a denial-of-service (DoS) condition in Qualcomm modems by sending specially crafted invalid messages on the DCCH channel. The NULL pointer dereference can crash the modem, disrupting cellular connectivity. This affects devices using vulnerable Qualcomm modem chipsets.
💻 Affected Systems
- Qualcomm modem chipsets
📦 What is this software?
Snapdragon 7c\+ Gen 3 Compute Firmware by Qualcomm
View all CVEs affecting Snapdragon 7c\+ Gen 3 Compute Firmware →
Snapdragon Auto 5g Modem Rf Firmware by Qualcomm
View all CVEs affecting Snapdragon Auto 5g Modem Rf Firmware →
Snapdragon W5\+ Gen 1 Wearable Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon W5\+ Gen 1 Wearable Platform Firmware →
Snapdragon X55 5g Modem Rf System Firmware by Qualcomm
View all CVEs affecting Snapdragon X55 5g Modem Rf System Firmware →
Snapdragon X65 5g Modem Rf System Firmware by Qualcomm
View all CVEs affecting Snapdragon X65 5g Modem Rf System Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Permanent modem crash requiring device reboot, complete loss of cellular connectivity including emergency services access.
Likely Case
Temporary modem crash causing dropped calls, lost data connectivity, and service disruption until modem resets.
If Mitigated
Minimal impact with proper network filtering and updated firmware preventing invalid message delivery.
🎯 Exploit Status
Exploitation requires ability to send invalid DCCH messages to target device, typically requiring cellular network access or proximity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to May 2023 Qualcomm security bulletin for specific patched versions
Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply Qualcomm modem firmware patches. 3. Reboot device after update. 4. Verify patch installation through device settings.
🔧 Temporary Workarounds
Network filtering
allImplement network-level filtering to block invalid DCCH messages
🧯 If You Can't Patch
- Isolate vulnerable devices from untrusted cellular networks when possible
- Implement monitoring for modem crash events and service disruptions
🔍 How to Verify
Check if Vulnerable:
Check device modem firmware version against Qualcomm's patched versions in May 2023 bulletinCheck Version:
Device-specific: Check Settings > About Phone > Baseband version on Android devicesVerify Fix Applied:
Verify modem firmware has been updated to patched version and monitor for stability📡 Detection & Monitoring
Log Indicators:
- Modem crash logs
- Unexpected modem resets
- DCCH protocol errors
Network Indicators:
- Unusual DCCH message patterns
- Modem disconnection events
SIEM Query:
Search for modem crash events, baseband processor failures, or cellular service disruption logs