Actively exploited · Published Jan 7, 2022 · Assigned by Samsung Mobile
CVE-2022-22265
Medium 5.0 Exploited
In plain English
A medium-severity security flaw in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on September 18, 2023). The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 9, 2023.
Official description
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Samsung Mobile | Samsung Mobile Devices | O(8.x), P(9.0), Q(10.0), R(11.0), S(12.0) – before SMR Jan-2022 Release 1 |
Weakness: CWE-703 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L