CVE-2022-25672 in Snapdragon Mobile
Summary
by MITRE • 12/13/2022
Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
This vulnerability represents a critical denial of service condition affecting Qualcomm Snapdragon mobile platforms where a malformed SIB1 message can trigger an assertion failure during modem processing. The issue manifests when the baseband modem receives a System Information Block Type 1 message containing invalid bandwidth parameters that cause the modem to enter an unrecoverable assertion state. The vulnerability stems from insufficient input validation within the modem firmware's SIB1 processing logic, specifically failing to properly validate bandwidth values against expected parameter ranges before proceeding with subsequent processing steps. This represents a classic example of inadequate error handling and input sanitization that falls under CWE-248, or "Uncaught Exception," where the system fails to gracefully handle malformed input data. The operational impact extends beyond simple service disruption as this vulnerability can affect device availability and potentially create conditions where mobile devices become completely unresponsive to network connections, impacting both voice and data services. According to ATT&CK framework category T1499.004, this vulnerability enables denial of service attacks that can render mobile devices inoperable. The flaw affects Snapdragon mobile platforms and occurs during the initial network registration process when the modem attempts to parse and process system information blocks from the serving cell. The assertion failure typically results in a modem crash or reset, requiring device reboot to restore normal operation. This vulnerability is particularly concerning in mobile environments where network connectivity is critical and unexpected service interruptions can have significant operational consequences. The root cause lies in the modem's failure to implement proper bounds checking for bandwidth parameters within the SIB1 message structure, allowing malformed data to propagate through the processing pipeline until it reaches a critical assertion point. The vulnerability demonstrates poor defensive programming practices and highlights the importance of implementing robust input validation mechanisms within embedded systems. Security researchers have identified that the issue affects multiple Snapdragon generations including those used in flagship smartphones and enterprise mobile devices. The attack vector requires an adversary to control or influence the network environment to inject a malformed SIB1 message, potentially through compromised base stations or network infrastructure. Mitigation strategies should include firmware updates from device manufacturers, implementation of network-level filtering to prevent malformed SIB1 messages, and enhanced modem error handling to prevent assertion failures from causing complete system crashes. Organizations should also consider network monitoring solutions that can detect unusual SIB1 message patterns and implement automatic failover mechanisms to minimize service disruption. The vulnerability underscores the importance of secure coding practices in embedded systems and the necessity of thorough input validation testing throughout the development lifecycle. This flaw exemplifies how seemingly minor validation gaps in mobile network processing can result in significant operational impacts and represents a common attack surface for adversaries seeking to disrupt mobile communications services.