Out of Bounds Write Vulnerability in MediaTek Modem 2G/3G Products
CVE-2022-20083

9.8CRITICAL

Key Information:

Vendor
MediaTek
Status
Mt2731, Mt2735, Mt6297, Mt6725, Mt6735, Mt6737, Mt6739, Mt6750, Mt6750s, Mt6755, Mt6757, Mt6757p, Mt6758, Mt6761, Mt6762, Mt6762d, Mt6762m, Mt6763, Mt6765, Mt6765t, Mt6767, Mt6768, Mt6769, Mt6769t, Mt6769z, Mt6771, Mt6775, Mt6779, Mt6781, Mt6783, Mt6785, Mt6785t, Mt6789, Mt6797, Mt6799, Mt6833, Mt6853, Mt6855, Mt6873, Mt6875, Mt6877, Mt6879, Mt6880, Mt6883, Mt6885, Mt6889, Mt6890, Mt6891, Mt6893, Mt6895, Mt6983, Mt8666, Mt8667, Mt8675, Mt8735a, Mt8735b, Mt8765, Mt8766, Mt8768, Mt8771, Mt8781, Mt8786, Mt8788, Mt8789, Mt8791, Mt8797
Vendor
CVE Published:
6 July 2022

Summary

An out of bounds write vulnerability exists in MediaTek's Modem 2G/3G CC, originating from a missing bounds check. This issue could be exploited by an attacker to execute arbitrary code remotely while decoding combined FACILITY data. Notably, this vulnerability does not require any additional execution privileges or user interaction, making it particularly concerning for device security. Affected products should be updated promptly to mitigate potential risks associated with this vulnerability.

Affected Version(s)

MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6755, MT6757, MT6757P, MT6758, MT6761, MT6762, MT6762D, MT6762M, MT6763, MT6765, MT6765T, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT6771, MT6775, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6797, MT6799, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT6895, MT6983, MT8666, MT8667, MT8675, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791, MT8797 Modem LR9, LR11, LR12, LR12A, LR13, NR15, NR16

References

https://corp.mediatek.com/product-security-bulletin/July-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.