Sign-up

ID

VAR-202207-0287


CVE

CVE-2022-21786


TITLE

Multiple MediaTek chip audio DSP type conversion vulnerabilities

Trust: 0.6

sources: CNVD: CNVD-2022-66246

DESCRIPTION

In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822. MediaTek Inc. is the world's fourth largest fab semiconductor company, with a leading position in mobile terminals, smart home applications, wireless connectivity technologies and IoT products, with approximately 1.5 billion units a year End products with built-in MediaTek chips are available worldwide. There are type conversion vulnerabilities in the audio DSPs of several MediaTek chips, which can be exploited by attackers to escalate privileges without requiring user interaction

Trust: 1.53

sources: NVD: CVE-2022-21786 // CNVD: CNVD-2022-66246 // VULMON: CVE-2022-21786

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-66246

AFFECTED PRODUCTS

vendor:googlemodel:androidscope:eqversion:12.0

Trust: 1.0

vendor:googlemodel:androidscope:eqversion:11.0

Trust: 1.0

vendor:mediatekmodel:mt6833 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6833 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6873 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6873 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6877 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6877 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6885 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6885 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6983 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6983 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8797 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8797 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6853 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6853 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6879 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6879 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6893 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6893 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6895 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt6895 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8791 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8791 android12.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8798 android11.0scope: - version: -

Trust: 0.6

vendor:mediatekmodel:mt8798 android12.0scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-66246 // NVD: CVE-2022-21786

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-21786
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2022-66246
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202207-453
value: MEDIUM

Trust: 0.6

VULMON: CVE-2022-21786
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-21786
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2022-66246
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-21786
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-66246 // VULMON: CVE-2022-21786 // CNNVD: CNNVD-202207-453 // NVD: CVE-2022-21786

PROBLEMTYPE DATA

problemtype:CWE-704

Trust: 1.0

sources: NVD: CVE-2022-21786

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-453

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202207-453

PATCH

title:Patch for Multiple MediaTek chip audio DSP type conversion vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/353591

Trust: 0.6

title:MediaTek Repair measures for chip code bugsurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=199230

Trust: 0.6

sources: CNVD: CNVD-2022-66246 // CNNVD: CNNVD-202207-453

EXTERNAL IDS

db:NVDid:CVE-2022-21786

Trust: 2.3

db:CNVDid:CNVD-2022-66246

Trust: 0.6

db:CS-HELPid:SB2022070819

Trust: 0.6

db:CNNVDid:CNNVD-202207-453

Trust: 0.6

db:VULMONid:CVE-2022-21786

Trust: 0.1

sources: CNVD: CNVD-2022-66246 // VULMON: CVE-2022-21786 // CNNVD: CNNVD-202207-453 // NVD: CVE-2022-21786

REFERENCES

url:https://corp.mediatek.com/product-security-bulletin/july-2022

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2022-21786

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022070819

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-21786/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/704.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-66246 // VULMON: CVE-2022-21786 // CNNVD: CNNVD-202207-453 // NVD: CVE-2022-21786

SOURCES

db:CNVDid:CNVD-2022-66246
db:VULMONid:CVE-2022-21786
db:CNNVDid:CNNVD-202207-453
db:NVDid:CVE-2022-21786

LAST UPDATE DATE

2024-08-14T13:00:08.950000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-66246date:2022-09-28T00:00:00
db:VULMONid:CVE-2022-21786date:2022-07-14T00:00:00
db:CNNVDid:CNNVD-202207-453date:2022-07-15T00:00:00
db:NVDid:CVE-2022-21786date:2022-07-14T02:02:15.527

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-66246date:2022-09-29T00:00:00
db:VULMONid:CVE-2022-21786date:2022-07-06T00:00:00
db:CNNVDid:CNNVD-202207-453date:2022-07-06T00:00:00
db:NVDid:CVE-2022-21786date:2022-07-06T14:15:18.177