CVE-2024-20085

Sept. 5, 2024, 2:26 p.m.

CVSS Score

4.4 / 10

Products Impacted

Vendor Product Versions
linuxfoundation
  • yocto
  • 2.6, 3.3, 4.0
rdkcentral
  • rdk-b
  • 2022q3
google
  • android
  • 13.0, 14.0
openwrt
  • openwrt
  • 19.07.0, 21.02, 22.03.5
mediatek
  • mt6580
  • mt6739
  • mt6761
  • mt6765
  • mt6768
  • mt6779
  • mt6781
  • mt6785
  • mt6789
  • mt6833
  • mt6835
  • mt6853
  • mt6855
  • mt6873
  • mt6877
  • mt6879
  • mt6880
  • mt6883
  • mt6885
  • mt6886
  • mt6889
  • mt6890
  • mt6893
  • mt6895
  • mt6897
  • mt6980
  • mt6983
  • mt6985
  • mt6989
  • mt6990
  • mt8183
  • mt8188
  • mt8195
  • mt8390
  • mt8395
  • mt8673
  • mt8675
  • mt8676
  • mt8678
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -
  • -

Description

In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08944204; Issue ID: MSV-1560.

Weaknesses

CWE-125
Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE ID: 125

Date

Published: Sept. 2, 2024, 5:15 a.m.

Last Modified: Sept. 5, 2024, 2:26 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@mediatek.com

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a linuxfoundation yocto 2.6 / / / / / / /
a linuxfoundation yocto 3.3 / / / / / / /
a linuxfoundation yocto 4.0 / / / / / / /
a rdkcentral rdk-b 2022q3 / / / / / / /
o google android 13.0 / / / / / / /
o google android 14.0 / / / / / / /
o openwrt openwrt 19.07.0 / / / / / / /
o openwrt openwrt 21.02 / / / / / / /
o openwrt openwrt 22.03.5 / / / / / / /
h mediatek mt6580 - / / / / / / /
h mediatek mt6739 - / / / / / / /
h mediatek mt6761 - / / / / / / /
h mediatek mt6765 - / / / / / / /
h mediatek mt6768 - / / / / / / /
h mediatek mt6779 - / / / / / / /
h mediatek mt6781 - / / / / / / /
h mediatek mt6785 - / / / / / / /
h mediatek mt6789 - / / / / / / /
h mediatek mt6833 - / / / / / / /
h mediatek mt6835 - / / / / / / /
h mediatek mt6853 - / / / / / / /
h mediatek mt6855 - / / / / / / /
h mediatek mt6873 - / / / / / / /
h mediatek mt6877 - / / / / / / /
h mediatek mt6879 - / / / / / / /
h mediatek mt6880 - / / / / / / /
h mediatek mt6883 - / / / / / / /
h mediatek mt6885 - / / / / / / /
h mediatek mt6886 - / / / / / / /
h mediatek mt6889 - / / / / / / /
h mediatek mt6890 - / / / / / / /
h mediatek mt6893 - / / / / / / /
h mediatek mt6895 - / / / / / / /
h mediatek mt6897 - / / / / / / /
h mediatek mt6980 - / / / / / / /
h mediatek mt6983 - / / / / / / /
h mediatek mt6985 - / / / / / / /
h mediatek mt6989 - / / / / / / /
h mediatek mt6990 - / / / / / / /
h mediatek mt8183 - / / / / / / /
h mediatek mt8188 - / / / / / / /
h mediatek mt8195 - / / / / / / /
h mediatek mt8390 - / / / / / / /
h mediatek mt8395 - / / / / / / /
h mediatek mt8673 - / / / / / / /
h mediatek mt8675 - / / / / / / /
h mediatek mt8676 - / / / / / / /
h mediatek mt8678 - / / / / / / /

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score
4.4
Exploitability Score
0.8
Impact Score
3.6
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References