SB2022020862 - Multiple vulnerabilities in MediaTek chipsets
Published: February 8, 2022 Updated: March 7, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Improper Input Validation (CVE-ID: CVE-2022-20024)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing permission check within system service. A local application can execute arbitrary code.
2) Stack-based buffer overflow (CVE-ID: CVE-2022-20025)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within Bluetooth. A local application can execute arbitrary code.
3) Heap-based Buffer Overflow (CVE-ID: CVE-2022-20026)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within Bluetooth. A local application can execute arbitrary code.
4) Write-what-where Condition (CVE-ID: CVE-2022-20027)
CWE-ID: CWE-123 - Write-what-where Condition
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within Bluetooth. A local application can execute arbitrary code.
5) Write-what-where Condition (CVE-ID: CVE-2022-20028)
CWE-ID: CWE-123 - Write-what-where Condition
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within Bluetooth. A local application can execute arbitrary code.
6) Out-of-bounds read (CVE-ID: CVE-2022-20029)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to an incorrect bounds check within cmdq driver. A local privileged application can gain access to sensitive information.
7) Stack-based buffer overflow (CVE-ID: CVE-2022-20030)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a stack within vow driver. A local privileged application can execute arbitrary code.
8) Use After Free (CVE-ID: CVE-2022-20031)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a use after free within fb driver. A local application can execute arbitrary code.
9) Out-of-bounds read (CVE-ID: CVE-2022-20032)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a race condition within vow driver. A local privileged application can gain access to sensitive information.
10) Out-of-bounds read (CVE-ID: CVE-2022-20033)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to an incorrect bounds check within camera driver. A local privileged application can gain access to sensitive information.
11) Information Exposure (CVE-ID: CVE-2022-20017)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to an incorrect bounds check within ion driver. A local application can gain access to sensitive information.
12) Improper Authentication (CVE-ID: CVE-2022-20034)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to an improper certificate validation within Preloader XFLASH. A local application can execute arbitrary code.
13) Information Exposure (CVE-ID: CVE-2022-20036)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to an incorrect bounds check within ion driver. A local application can gain access to sensitive information.
14) Use After Free (CVE-ID: CVE-2022-20035)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a use after free within vcu driver. A local privileged application can execute arbitrary code.
15) Information Exposure (CVE-ID: CVE-2022-20037)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to an incorrect bounds check within ion driver. A local application can gain access to sensitive information.
16) Memory corruption (CVE-ID: CVE-2022-20038)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to an incorrect bounds check within ccu driver. A local privileged application can execute arbitrary code.
17) Integer overflow (CVE-ID: CVE-2022-20039)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to an integer overflow within ccu driver. A local privileged application can execute arbitrary code.
18) Stack-based buffer overflow (CVE-ID: CVE-2022-20040)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a stack within power_hal_manager_service. A local application can execute arbitrary code.
19) Improper Privilege Management (CVE-ID: CVE-2022-20041)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing permission check within Bluetooth. A local application can execute arbitrary code.
20) Information Exposure (CVE-ID: CVE-2022-20042)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to incorrect error handling within Bluetooth. A local application can gain access to sensitive information.
21) Improper Privilege Management (CVE-ID: CVE-2022-20043)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing permission check within Bluetooth. A local application can execute arbitrary code.
22) Use After Free (CVE-ID: CVE-2022-20044)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a use after free within Bluetooth. A local application can execute arbitrary code.
23) Use After Free (CVE-ID: CVE-2022-20045)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a use after free within Bluetooth. A local application can execute arbitrary code.
24) Improper Release of Memory Before Removing Last Reference ('Memory Leak') (CVE-ID: CVE-2022-20046)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a logic error within Bluetooth. A local application can perform service disruption.
Remediation
Install update from vendor's website.