Qualcomm Chipsets and Lenovo BIOS Get Security Updates to Fix Multiple Flaws

Jan 04, 2023Ravie LakshmananFirmware Security

Qualcomm on Tuesday released patches^[1]
to address multiple security flaws in its chipsets, some of which
could be exploited to cause information disclosure and memory
corruption.

The five vulnerabilities — tracked from CVE-2022-40516 through
CVE-2022-40520 — also impact Lenovo ThinkPad X13s laptops,
prompting the Chinese PC maker to issue BIOS updates to plug the
security holes.

The list of flaws is as follows –

• CVE-2022-40516, CVE-2022-40517 &
  CVE-2022-40520 (CVSS scores: 8.4) – Memory corruption in
  Core due to stack-based buffer overflow^[2]
• CVE-2022-40518 & CVE-2022-40519 (CVSS scores:
  6.8) – Information disclosure due to buffer over-read^[3]
  in Core

Stack-based buffer overflow vulnerabilities can result in severe
impacts, such as data corruption, system crashes, and arbitrary
code execution. Buffer over-reads, on the other hand, can be
weaponized to read out-of-bounds memory, leading to the exposure of
secret data.

Successful exploitation of the aforementioned flaws could allow
a local adversary with elevated privileges to cause memory
corruption or leak sensitive information, Lenovo noted^[4]
in an alert published Tuesday.

Also remediated by Lenovo are four more buffer over-read
vulnerabilities in ThinkPad X13 BIOS that could lead to information
disclosure. The flaws are tracked as CVE-2022-4432, CVE-2022-4433,
CVE-2022-4434, and CVE-2022-4435.

ThinkPad X13 users are recommended to update the BIOS to version
1.47 (N3HET75W) or newer. Firmware security firm Binarly has been
credited with discovering and reporting the nine shortcomings.

Qualcomm’s January 2023 security bulletin further closes out 17
other vulnerabilities, including one critical memory corruption bug
in the Automotive component (CVE-2022-33219, CVSS score: 9.3)
arising as a result of a buffer overflow flaw.