Out of Bounds Write Vulnerability in MediaTek's VCU
CVE-2023-20745

6.7MEDIUM

Key Information:

Vendor
MediaTek
Status
MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT8781, MT8786, MT8789, MT8791, MT8797
Vendor
CVE Published:
6 June 2023

Summary

A notable vulnerability exists in MediaTek's VCU, stemming from improper locking mechanisms, which may lead to an out of bounds write condition. This flaw could enable local users to escalate their privileges to system-level execution without requiring any user interaction for exploitation. The vulnerability highlights the importance of proper security measures in software design and the need for timely updates to mitigate potential risks. Affected versions should be updated using the provided patch ID ALPS07519142.

Affected Version(s)

MT6789, MT6855, MT8185, MT8195, MT8365, MT8395, MT8781, MT8786, MT8789, MT8791, MT8797 Android 12.0, 13.0 / Yocto 4.0 / Iot-Yocto 22.2

References

https://corp.mediatek.com/product-security-bulletin/June-...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.