Lucene search

[email protected]CVE-2022-20039

HistoryFeb 09, 2022 - 11:15 p.m.

CVE-2022-20039

2022-02-0923:15:17

CWE-190

[email protected]

web.nvd.nist.gov

ccu driver

memory corruption

integer overflow

local privilege escalation

cve-2022-20039

alps06183345

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.6%

JSON

In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06183345; Issue ID: ALPS06183345.

Affected configurations

Vulners

NVD

Node

googleandroidRange<11.0

mediatekmt6833

mediatekmt6853

mediatekmt6873

mediatekmt6877

mediatekmt6883

mediatekmt6893

mediatekmt8791

mediatekmt8797

VendorProductVersionCPE
googleandroid*cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
mediatekmt6833*cpe:2.3:h:mediatek:mt6833:*:*:*:*:*:*:*:*
mediatekmt6853*cpe:2.3:h:mediatek:mt6853:*:*:*:*:*:*:*:*
mediatekmt6873*cpe:2.3:h:mediatek:mt6873:*:*:*:*:*:*:*:*
mediatekmt6877*cpe:2.3:h:mediatek:mt6877:*:*:*:*:*:*:*:*
mediatekmt6883*cpe:2.3:h:mediatek:mt6883:*:*:*:*:*:*:*:*
mediatekmt6893*cpe:2.3:h:mediatek:mt6893:*:*:*:*:*:*:*:*
mediatekmt8791*cpe:2.3:h:mediatek:mt8791:*:*:*:*:*:*:*:*
mediatekmt8797*cpe:2.3:h:mediatek:mt8797:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	*	cpe:2.3:o:google:android::::::::
mediatek	mt6833	*	cpe:2.3:h:mediatek:mt6833::::::::
mediatek	mt6853	*	cpe:2.3:h:mediatek:mt6853::::::::
mediatek	mt6873	*	cpe:2.3:h:mediatek:mt6873::::::::
mediatek	mt6877	*	cpe:2.3:h:mediatek:mt6877::::::::
mediatek	mt6883	*	cpe:2.3:h:mediatek:mt6883::::::::
mediatek	mt6893	*	cpe:2.3:h:mediatek:mt6893::::::::
mediatek	mt8791	*	cpe:2.3:h:mediatek:mt8791::::::::
mediatek	mt8797	*	cpe:2.3:h:mediatek:mt8797::::::::

CNA Affected

[
  {
    "product": "MT6833, MT6853, MT6873, MT6877, MT6883, MT6893, MT8791, MT8797",
    "vendor": "MediaTek, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Android 11.0"
      }
    ]
  }
]

References

corp.mediatek.com/product-security-bulletin/February-2022

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2022-20039

cvelist1 prion1 nvd1