In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519217.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
MediaTek, Inc. MT6789, MT6855, MT8167, MT8168, MT8173, MT8185, MT8195, MT8321, MT8365, MT8395, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 affected
Version Status Constraints
Android 12.0, 13.0 / Yocto 4.0 / Iot-Yocto 22.2 affected —

Configuration 1 [-]

AND
OR cpe:2.3:a:linuxfoundation:iot-yocto:22.2:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8167:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8173:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8185:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8321:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Google Subscribe
Android Subscribe
Linuxfoundation Subscribe
Iot-yocto Subscribe
Yocto Subscribe
Mediatek Subscribe
Mt6789 Subscribe
Mt6855 Subscribe
Mt8167 Subscribe
Mt8168 Subscribe
Mt8173 Subscribe
Mt8185 Subscribe
Mt8195 Subscribe
Mt8321 Subscribe
Mt8365 Subscribe
Mt8395 Subscribe
Mt8765 Subscribe
Mt8766 Subscribe
Mt8768 Subscribe
Mt8781 Subscribe
Mt8786 Subscribe
Mt8788 Subscribe
Mt8789 Subscribe
Mt8791 Subscribe
Mt8791t Subscribe
Mt8797 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24925 In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519217.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://corp.mediatek.com/product-security-bulletin/June-2023 cve-icon cve-icon
History

Tue, 07 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: MediaTek

Published:

Updated: 2025-01-07T19:22:00.478Z

Reserved: 2022-10-28T02:03:10.769Z

Link: CVE-2023-20746

cve-icon Vulnrichment

Updated: 2024-08-02T09:14:40.970Z

cve-icon NVD

Status : Modified

Published: 2023-06-06T13:15:14.723

Modified: 2025-01-07T20:15:28.743

Link: CVE-2023-20746

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses