#VU73078 Stack-based buffer overflow in MediaTek products - CVE-2022-20105

Vulnerability identifier: #VU73078

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-20105

CWE-ID: CWE-121

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
MT9011
MT9215
MT9216
MT9220
MT9221
MT9255
MT9256
MT9266
MT9269
MT9285
MT9286
MT9288
MT9600
MT9602
MT9610
MT9611
MT9612
MT9613
MT9615
MT9617
MT9629
MT9630
MT9631
MT9632
MT9636
MT9638
MT9639
MT9650
MT9652
MT9666
MT9669
MT9670
MT9675
MT9685
MT9686
MT9688

Software vendor:
MediaTek

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a stack within MM service. A local privileged application can execute arbitrary code.

Install security update from vendor's website.

• https://corp.mediatek.com/product-security-bulletin/May-2022