Out-of-bounds read in UNISOC products - CVE-2023-49668
Published: February 5, 2024
Vulnerability identifier: #VU86095
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-49668
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the cp_dump driver in Kernel. A local application can execute arbitrary code.
Affected software
SC9863A
T606
T612
T616
T610
T618
T760
T770
T820
S8000
Google Android
T606
T612
T616
T610
T618
T760
T770
T820
S8000
Google Android
How to mitigate CVE-2023-49668
Install security update from vendor's website.
Google Android - addressed in versions 11 2024-02-05, 12L 2024-02-05, 12 2024-02-05, 13 2024-02-05, 14 2024-02-05