Buffer over-read in UNISOC products - CVE-2023-49667
Published: February 5, 2024
Vulnerability identifier: #VU86096
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-49667
CWE-ID: CWE-126
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the cp dump driver in Kernel. A local application can execute arbitrary code.
Affected software
T618
S8000
S8000SC9863A
T820
T770
T760
SC9863A
T610
T616
T612
T606
Google Android
S8000
S8000SC9863A
T820
T770
T760
SC9863A
T610
T616
T612
T606
Google Android
How to mitigate CVE-2023-49667
Install security update from vendor's website.
Google Android - addressed in versions 11 2024-02-05, 12L 2024-02-05, 12 2024-02-05, 13 2024-02-05, 14 2024-02-05