SB2023060522 - Multiple vulnerabilities in Unisoc chipsets

Security Bulletin ID SB2023060522

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 20

Exploitation vector Local access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 20 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2022-48390)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

2) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2022-48391)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

3) Missing Authorization (CVE-ID: CVE-2022-48392)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer service in Android. A local application can read and manipulate data.

4) Out-of-bounds write (CVE-ID: CVE-2022-48438)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read, manipulate or delete data.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the cp_dump driver in Kernel. A local application can read, manipulate or delete data.

5) Buffer overflow (CVE-ID: CVE-2022-48439)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to gain access to sensitive information.

The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the cp_dump driver in Kernel. A local privileged application can gain access to sensitive information.

6) Resource exhaustion (CVE-ID: CVE-2022-48440)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

7) Resource exhaustion (CVE-ID: CVE-2022-48441)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

8) NULL Pointer Dereference (CVE-ID: CVE-2022-48442)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the dialer in Android. A local application can read and manipulate data.

9) NULL Pointer Dereference (CVE-ID: CVE-2022-48443)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

10) NULL Pointer Dereference (CVE-ID: CVE-2022-48444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

11) NULL Pointer Dereference (CVE-ID: CVE-2022-48446)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

12) NULL Pointer Dereference (CVE-ID: CVE-2022-48445)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

13) NULL Pointer Dereference (CVE-ID: CVE-2022-48447)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

14) NULL Pointer Dereference (CVE-ID: CVE-2022-48448)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can read and manipulate data.

15) Missing Authorization (CVE-ID: CVE-2023-30863)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the Connectivity Service in Android. A local application can gain access to sensitive information.

16) Missing Authorization (CVE-ID: CVE-2023-30864)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a possible missing permission check within the Connectivity Service in Android. A local application can gain access to sensitive information.

17) Information exposure (CVE-ID: CVE-2023-30865)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the dialer service in Android. A local application can gain access to sensitive information.

18) Information exposure (CVE-ID: CVE-2023-30866)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within the telephony service in Android. A local application can gain access to sensitive information.

19) Information exposure (CVE-ID: CVE-2023-30914)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.

20) Information exposure (CVE-ID: CVE-2023-30915)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.