SB2023010410 - Multiple vulnerabilities in MediaTek chipsets
Published: January 4, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2022-32649)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within jpeg component. A local application can trigger use-after-free and escalate privileges on the system.
2) Input validation error (CVE-ID: CVE-2022-32665)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input within Boa component. A local application can send a specially crafted input and escalate privileges on the system.
3) Input validation error (CVE-ID: CVE-2022-32664)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input within Config Manager component. A local application can trick the victim into opening a specially crafted input and escalate privileges on the system.
4) Error Handling (CVE-ID: CVE-2022-32659)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an error handling within Wi-Fi driver. A local application can trigger error handling and escalate privileges on the system.
5) Error Handling (CVE-ID: CVE-2022-32658)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an error handling within Wi-Fi driver. A local application can trigger error handling and escalate privileges on the system.
6) Error Handling (CVE-ID: CVE-2022-32657)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to an error handling within Wi-Fi driver. A local application can trigger error handling and escalate privileges on the system.
7) Out-of-bounds write (CVE-ID: CVE-2022-32623)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within mdp component. A local application can trigger out-of-bounds write and escalate privileges on the system.
8) Use-after-free (CVE-ID: CVE-2022-32653)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within mtk-aie component. A local application can trigger use-after-free to escalate privileges on the system.
9) Use-after-free (CVE-ID: CVE-2022-32652)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within mtk-aie component. A local application can trigger use-after-free to escalate privileges on the system.
10) Use-after-free (CVE-ID: CVE-2022-32651)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within mtk-aie component. A local application can trigger use-after-free to escalate privileges on the system.
11) Use-after-free (CVE-ID: CVE-2022-32650)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within mtk-isp component. A local application can trigger use-after-free to escalate privileges on the system.
12) Race condition (CVE-ID: CVE-2022-32648)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
13) Out-of-bounds write (CVE-ID: CVE-2022-32635)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within the gps component. A local application can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
14) Out-of-bounds write (CVE-ID: CVE-2022-32647)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within ccu component. A local application can trigger out-of-bounds write and escalate privileges on the system.
15) Stack-based buffer overflow (CVE-ID: CVE-2022-32646)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within gpu drm component. A local application can trigger stack-based buffer overflow and escalate privileges on the system.
16) Race condition (CVE-ID: CVE-2022-32645)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition within vow component. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
17) Race condition (CVE-ID: CVE-2022-32644)
The vulnerability allows a a local application to escalate privileges on the system.
The vulnerability exists due to a race condition within vow component. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
18) Out-of-bounds read (CVE-ID: CVE-2022-32641)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary condition within meta wifi component. A local application can trigger out-of-bounds read error and escalate privileges on the system.
19) Out-of-bounds write (CVE-ID: CVE-2022-32640)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within meta wifi component. A local application can trigger out-of-bounds write and escalate privileges on the system.
20) Out-of-bounds read (CVE-ID: CVE-2022-32639)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary condition within watchdog component. A local application can trigger out-of-bounds read error and escalate privileges on the system.
21) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2022-32638)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a race condition within isp component. A local application can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
22) Out-of-bounds write (CVE-ID: CVE-2022-32637)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to a boundary error within hevc decoder component. A local application can trigger out-of-bounds write and escalate privileges on the system.
23) Integer overflow (CVE-ID: CVE-2022-32636)
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to integer overflow within the keyinstall component. A local application can trigger integer overflow and escalate privileges on the system.
Remediation
Install update from vendor's website.