Race condition in MediaTek products - CVE-2022-20082

Vulnerability identifier: #VU65026

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20082

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a race condition in GPU component. A local application can exploit the race to trigger a use-after-free error and escalate privileges on the system.

MT6875
MT6893
MT6889
MT6885
MT6883
MT6877
MT6873
MT6853T
MT6853
MT6785
MT6781
MT6983
MT6895
MT6879
MT6768
MT6833
MT6789
MT6769
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 10 2022-08-05, 11 2022-08-05, 12L 2022-08-05, 12 2022-08-05

• https://corp.mediatek.com/product-security-bulletin/July-2022

• Multiple vulnerabilities in MediaTek chipsets
• Multiple vulnerabilities in Google Android