Out of Bounds Write Vulnerability in MediaTek Modem 2G RR
CVE-2022-21744

9.8CRITICAL

Key Information:

Vendor
MediaTek
Status
Mt2731, Mt2735, Mt6297, Mt6725, Mt6735, Mt6737, Mt6739, Mt6750, Mt6750s, Mt6755, Mt6757, Mt6757p, Mt6758, Mt6761, Mt6762, Mt6762d, Mt6762m, Mt6763, Mt6765, Mt6765t, Mt6767, Mt6768, Mt6769, Mt6769t, Mt6769z, Mt6771, Mt6775, Mt6779, Mt6781, Mt6783, Mt6785, Mt6785t, Mt6789, Mt6797, Mt6799, Mt6833, Mt6853, Mt6855, Mt6873, Mt6875, Mt6877, Mt6879, Mt6880, Mt6883, Mt6885, Mt6889, Mt6890, Mt6891, Mt6893, Mt6895, Mt6983, Mt8666, Mt8667, Mt8675, Mt8735a, Mt8735b, Mt8765, Mt8766, Mt8768, Mt8771, Mt8781, Mt8786, Mt8788, Mt8789, Mt8791, Mt8797
Vendor
CVE Published:
6 July 2022

Summary

An out of bounds write vulnerability exists in the MediaTek Modem 2G RR, caused by a missing bounds check. This flaw may allow an attacker to exploit improper neighbouring cell size when decoding GPRS Packet Neighbour Cell Data (PNCD), which can result in unauthorized remote code execution without the need for user interaction. Affected users are advised to apply the latest patches to mitigate security risks associated with this vulnerability.

Affected Version(s)

MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6755, MT6757, MT6757P, MT6758, MT6761, MT6762, MT6762D, MT6762M, MT6763, MT6765, MT6765T, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT6771, MT6775, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6797, MT6799, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT6895, MT6983, MT8666, MT8667, MT8675, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791, MT8797 Modem LR9, LR11, LR12, LR12A, LR13, NR15, NR16

References

https://corp.mediatek.com/product-security-bulletin/July-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.