Potential Out of Bounds Read in Mediatek img_sys Command Queue
CVE-2023-20846

4.2MEDIUM

Key Information:

Vendor

MediaTek
Status
Mt6895, Mt6897, Mt6983, Mt8188, Mt8195, Mt8395, Mt8781
Vendor
CVE Published:
4 September 2023

What is CVE-2023-20846?

The img_sys command queue in Mediatek devices has a vulnerability where there is a possibility of an out-of-bounds read due to missing valid range checks. This flaw may lead to local information disclosure, requiring system execution privileges to exploit. Successful exploitation of this vulnerability necessitates user interaction, emphasizing the importance of maintaining updated systems to prevent potential security risks. For further details, refer to the Mediatek product security bulletin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Android 11.0, 12.0 / Linux 6.1 / IOT-v23.0 / Yocto 4.0

References

https://corp.mediatek.com/product-security-bulletin/Septe...

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.