Vulnerability Name:

CVE-2022-20020 (CCN-216598)

Assigned:2021-10-12
Published:2022-01-03
Updated:2022-01-11
Summary:In libvcodecdrv, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05943906; Issue ID: ALPS05943906.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-119
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2022-20020

Source: CCN
Type: MediaTek Web site
January 2022 Product Security Bulletin

Source: MISC
Type: Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/January-2022

Source: XF
Type: UNKNOWN
mediatek-cve202220020-info-disc(216598)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:google:android:11.0:*:*:*:*:*:*:*
  • AND
  • cpe:/h:mediatek:mt6739:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6768:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6779:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6781:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6785:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6833:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6853:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6873:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6877:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6885:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6893:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8167:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8168:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8173:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8185:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8321:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8362a:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8365:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8385:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8765:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8766:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8768:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8786:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8788:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8789:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8791:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8797:-:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    google android 11.0
    mediatek mt6739 -
    mediatek mt6768 -
    mediatek mt6779 -
    mediatek mt6781 -
    mediatek mt6785 -
    mediatek mt6833 -
    mediatek mt6853 -
    mediatek mt6873 -
    mediatek mt6877 -
    mediatek mt6885 -
    mediatek mt6893 -
    mediatek mt8167 -
    mediatek mt8168 -
    mediatek mt8173 -
    mediatek mt8185 -
    mediatek mt8321 -
    mediatek mt8362a -
    mediatek mt8365 -
    mediatek mt8385 -
    mediatek mt8765 -
    mediatek mt8766 -
    mediatek mt8768 -
    mediatek mt8786 -
    mediatek mt8788 -
    mediatek mt8789 -
    mediatek mt8791 -
    mediatek mt8797 -