SB2023060522 - Multiple vulnerabilities in Unisoc chipsets

Description

This security bulletin contains information about 20 vulnerabilities.

1) NULL Pointer Dereference (CVE-ID: CVE-2022-48446)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

2) Information exposure (CVE-ID: CVE-2023-30915)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.

3) Information exposure (CVE-ID: CVE-2023-30914)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.

4) Information exposure (CVE-ID: CVE-2023-30866)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.

5) Information exposure (CVE-ID: CVE-2023-30865)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the dialer service in Android. A local application can gain access to sensitive information.

6) Missing Authorization (CVE-ID: CVE-2023-30864)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the Connectivity Service in Android. A local application can gain access to sensitive information.

7) Missing Authorization (CVE-ID: CVE-2023-30863)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the Connectivity Service in Android. A local application can gain access to sensitive information.

8) NULL Pointer Dereference (CVE-ID: CVE-2022-48448)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

9) NULL Pointer Dereference (CVE-ID: CVE-2022-48447)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

10) NULL Pointer Dereference (CVE-ID: CVE-2022-48445)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

11) Missing Authorization (CVE-ID: CVE-2022-48390)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

12) NULL Pointer Dereference (CVE-ID: CVE-2022-48444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

13) NULL Pointer Dereference (CVE-ID: CVE-2022-48443)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

14) NULL Pointer Dereference (CVE-ID: CVE-2022-48442)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

15) Resource exhaustion (CVE-ID: CVE-2022-48441)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

16) Resource exhaustion (CVE-ID: CVE-2022-48440)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

17) Buffer overflow (CVE-ID: CVE-2022-48439)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged application to gain access to sensitive information.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the cp_dump driver in Kernel. A local privileged application can gain access to sensitive information.

18) Out-of-bounds write (CVE-ID: CVE-2022-48438)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read, manipulate or delete data.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the cp_dump driver in Kernel. A local application can read, manipulate or delete data.

19) Missing Authorization (CVE-ID: CVE-2022-48392)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer service in Android. A local application can read and manipulate data.

20) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2022-48391)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

Remediation

Install update from vendor's website.

References

• https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498