SB2022110742 - Multiple vulnerabilities in Unisoc chipsets
Published: November 7, 2022 Updated: January 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 38 secuirty vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2022-39080)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.
2) Missing Authorization (CVE-ID: CVE-2022-39111)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
3) Missing Authorization (CVE-ID: CVE-2022-39110)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
4) Missing Authorization (CVE-ID: CVE-2022-39109)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
5) Missing Authorization (CVE-ID: CVE-2022-39108)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
6) Resource exhaustion (CVE-ID: CVE-2022-38679)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a missing permission check within the music service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.
7) Missing Authorization (CVE-ID: CVE-2022-39107)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Soundrecorder service in Android. A local application can manipulate or delete data.
8) Missing Authorization (CVE-ID: CVE-2022-39103)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a missing permission check within the Gallery service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.
9) Missing Authorization (CVE-ID: CVE-2022-38698)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.
10) Missing Authorization (CVE-ID: CVE-2022-39113)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
11) Missing Authorization (CVE-ID: CVE-2022-38697)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.
12) Missing Authorization (CVE-ID: CVE-2022-39117)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.
13) Resource exhaustion (CVE-ID: CVE-2022-38687)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a missing permission check within the messaging service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.
14) Resource exhaustion (CVE-ID: CVE-2022-38677)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the cellbroadcastreceiver in Android. A local application can manipulate or delete data.
15) Information Exposure (CVE-ID: CVE-2022-38689)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
16) Information Exposure (CVE-ID: CVE-2022-38688)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
17) Buffer over-read (CVE-ID: CVE-2022-38671)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the camera driver in Kernel. A local application can perform a denial of service (DoS) attack.
18) Missing Authorization (CVE-ID: CVE-2022-39112)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
19) Missing Authorization (CVE-ID: CVE-2022-39114)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
20) Heap-based buffer overflow (CVE-ID: CVE-2022-38676)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the gpu driver. A local application can trigger a heap-based buffer overflow and crash the kernel.
21) Buffer overflow (CVE-ID: CVE-2022-38690)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the camera driver. A local application can trigger memory corruption and crash the system.
22) Integer overflow (CVE-ID: CVE-2022-39105)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the sensor driver. A local application can trigger memory corruption and perform a denial of service (DoS) attack.
23) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-2985)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions within the Music service. A local application can escalate privileges on the system.
24) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-38670)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions within the soundrecorder service. A local application can escalate privileges on the system.25) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-38669)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions within the soundrecorder service. A local application can escalate privileges on the system.26) Out-of-bounds write (CVE-ID: CVE-2022-2984)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the jpg driver. A local application can trigger an out-of-bounds write and crash the kernel.
27) Out-of-bounds read (CVE-ID: CVE-2022-38673)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the face detect driver. A local application can trigger an out-of-bounds read and crash the kernel.
28) Stack-based buffer overflow (CVE-ID: CVE-2022-38672)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the face detect driver. A local application can trigger a stack-based buffer overflow and crash the kernel.
29) Resource exhaustion (CVE-ID: CVE-2022-39128)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
30) Missing Authorization (CVE-ID: CVE-2022-39115)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.
31) Resource exhaustion (CVE-ID: CVE-2022-39127)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
32) Resource exhaustion (CVE-ID: CVE-2022-39126)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
33) Resource exhaustion (CVE-ID: CVE-2022-39125)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
34) Resource exhaustion (CVE-ID: CVE-2022-39124)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
35) Resource exhaustion (CVE-ID: CVE-2022-39123)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
36) Buffer overflow (CVE-ID: CVE-2022-39122)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
37) Buffer overflow (CVE-ID: CVE-2022-39121)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.
38) Buffer overflow (CVE-ID: CVE-2022-39120)
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Android. A local application can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.