Lucene search

MediaTekCVE-2022-20078

HistoryApr 11, 2022 - 8:15 p.m.

CVE-2022-20078

2022-04-1120:15:19

CWE-362

MediaTek

web.nvd.nist.gov

cve-2022-20078

vow

memory corruption

race condition

local privilege escalation

system execution privileges

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05852819; Issue ID: ALPS05852819.

Affected configurations

Nvd

Vulners

Node

mediatekmt6833Match-

mediatekmt6853Match-

mediatekmt6853tMatch-

mediatekmt6873Match-

mediatekmt6877Match-

mediatekmt6883Match-

mediatekmt6885Match-

mediatekmt6889Match-

mediatekmt6891Match-

mediatekmt6893Match-

mediatekmt8791Match-

mediatekmt8797Match-

AND

googleandroidMatch11.0

googleandroidMatch12.0

VendorProductVersionCPE
mediatekmt6833-cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*
mediatekmt6853-cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*
mediatekmt6853t-cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*
mediatekmt6873-cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*
mediatekmt6877-cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*
mediatekmt6883-cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*
mediatekmt6885-cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*
mediatekmt6889-cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*
mediatekmt6891-cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*
mediatekmt6893-cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mediatek	mt6833	-	cpe:2.3:h:mediatek:mt6833:-:::::::*
mediatek	mt6853	-	cpe:2.3:h:mediatek:mt6853:-:::::::*
mediatek	mt6853t	-	cpe:2.3:h:mediatek:mt6853t:-:::::::*
mediatek	mt6873	-	cpe:2.3:h:mediatek:mt6873:-:::::::*
mediatek	mt6877	-	cpe:2.3:h:mediatek:mt6877:-:::::::*
mediatek	mt6883	-	cpe:2.3:h:mediatek:mt6883:-:::::::*
mediatek	mt6885	-	cpe:2.3:h:mediatek:mt6885:-:::::::*
mediatek	mt6889	-	cpe:2.3:h:mediatek:mt6889:-:::::::*
mediatek	mt6891	-	cpe:2.3:h:mediatek:mt6891:-:::::::*
mediatek	mt6893	-	cpe:2.3:h:mediatek:mt6893:-:::::::*

Rows per page:

1-10 of 141

CNA Affected

[
  {
    "product": "MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8791, MT8797",
    "vendor": "MediaTek, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Android 11.0, 12.0"
      }
    ]
  }
]

References

corp.mediatek.com/product-security-bulletin/April-2022

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-20078