Main Vulnerability Database SB2022110742

SB2022110742 - Multiple vulnerabilities in Unisoc chipsets

Published: November 7, 2022 Updated: January 9, 2023

Security Bulletin ID SB2022110742

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 38

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 38 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2022-39115)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

2) Buffer overflow (CVE-ID: CVE-2022-38690)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the camera driver. A local application can trigger memory corruption and crash the system.

3) Integer overflow (CVE-ID: CVE-2022-39105)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the sensor driver. A local application can trigger memory corruption and perform a denial of service (DoS) attack.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-2985)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions within the Music service. A local application can escalate privileges on the system.

5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-38670)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions within the soundrecorder service. A local application can escalate privileges on the system.

6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-38669)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions within the soundrecorder service. A local application can escalate privileges on the system.

7) Out-of-bounds write (CVE-ID: CVE-2022-2984)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the jpg driver. A local application can trigger an out-of-bounds write and crash the kernel.

8) Out-of-bounds read (CVE-ID: CVE-2022-38673)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the face detect driver. A local application can trigger an out-of-bounds read and crash the kernel.

9) Stack-based buffer overflow (CVE-ID: CVE-2022-38672)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the face detect driver. A local application can trigger a stack-based buffer overflow and crash the kernel.

10) Resource exhaustion (CVE-ID: CVE-2022-39128)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

11) Heap-based buffer overflow (CVE-ID: CVE-2022-38676)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the gpu driver. A local application can trigger a heap-based buffer overflow and crash the kernel.

12) Resource exhaustion (CVE-ID: CVE-2022-39127)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

13) Resource exhaustion (CVE-ID: CVE-2022-39126)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

14) Resource exhaustion (CVE-ID: CVE-2022-39125)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

15) Resource exhaustion (CVE-ID: CVE-2022-39124)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

16) Resource exhaustion (CVE-ID: CVE-2022-39123)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

17) Buffer overflow (CVE-ID: CVE-2022-39122)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

18) Buffer overflow (CVE-ID: CVE-2022-39121)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can perform a denial of service (DoS) attack.

19) Buffer overflow (CVE-ID: CVE-2022-39120)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Android. A local application can perform a denial of service (DoS) attack.

20) Missing Authorization (CVE-ID: CVE-2022-38697)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.

21) Missing Authorization (CVE-ID: CVE-2022-39111)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

22) Missing Authorization (CVE-ID: CVE-2022-39110)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

23) Missing Authorization (CVE-ID: CVE-2022-39109)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

24) Missing Authorization (CVE-ID: CVE-2022-39108)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

25) Resource exhaustion (CVE-ID: CVE-2022-38679)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a missing permission check within the music service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

26) Missing Authorization (CVE-ID: CVE-2022-39107)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Soundrecorder service in Android. A local application can manipulate or delete data.

27) Missing Authorization (CVE-ID: CVE-2022-39103)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a missing permission check within the Gallery service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

28) Missing Authorization (CVE-ID: CVE-2022-38698)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.

29) Missing Authorization (CVE-ID: CVE-2022-39113)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

30) Missing Authorization (CVE-ID: CVE-2022-39080)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.

31) Missing Authorization (CVE-ID: CVE-2022-39117)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the messaging service in Android. A local application can gain access to sensitive information.

32) Resource exhaustion (CVE-ID: CVE-2022-38687)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a missing permission check within the messaging service in Android. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

33) Resource exhaustion (CVE-ID: CVE-2022-38677)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the cellbroadcastreceiver in Android. A local application can manipulate or delete data.

34) Information Exposure (CVE-ID: CVE-2022-38689)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.

35) Information Exposure (CVE-ID: CVE-2022-38688)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.

36) Buffer over-read (CVE-ID: CVE-2022-38671)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform a denial of service (DoS) attack.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the camera driver in Kernel. A local application can perform a denial of service (DoS) attack.

37) Missing Authorization (CVE-ID: CVE-2022-39112)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.

38) Missing Authorization (CVE-ID: CVE-2022-39114)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to manipulate or delete data.

The vulnerability exists due to a missing permission check within the Music service in Android. A local application can manipulate or delete data.