CVE-2022-20066

In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729.

CVSS v3 4.4 MEDIUM
CVSS v2.0 2.1 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/May-2022	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:google:android:11.0:::::::*
	cpe:2.3:o:google:android:12.0:::::::*

OR	cpe:2.3:h:mediatek:mt6580:-:::::::*
	cpe:2.3:h:mediatek:mt6739:-:::::::*
	cpe:2.3:h:mediatek:mt6761:-:::::::*
	cpe:2.3:h:mediatek:mt6765:-:::::::*
	cpe:2.3:h:mediatek:mt6769:-:::::::*
	cpe:2.3:h:mediatek:mt6771:-:::::::*
	cpe:2.3:h:mediatek:mt6785:-:::::::*
	cpe:2.3:h:mediatek:mt6833:-:::::::*
	cpe:2.3:h:mediatek:mt6873:-:::::::*
	cpe:2.3:h:mediatek:mt6875:-:::::::*
	cpe:2.3:h:mediatek:mt6877:-:::::::*
	cpe:2.3:h:mediatek:mt6891:-:::::::*
	cpe:2.3:h:mediatek:mt8168:-:::::::*
	cpe:2.3:h:mediatek:mt8365:-:::::::*
	cpe:2.3:h:mediatek:mt8666:-:::::::*
	cpe:2.3:h:mediatek:mt8667:-:::::::*
	cpe:2.3:h:mediatek:mt8696:-:::::::*
	cpe:2.3:h:mediatek:mt8766:-:::::::*
	cpe:2.3:h:mediatek:mt8768:-:::::::*
	cpe:2.3:h:mediatek:mt8788:-:::::::*

History

No history.

Information

Published : 2022-04-11 20:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-20066

Mitre link : CVE-2022-20066

CVE.ORG link : CVE-2022-20066

JSON object : View

Products Affected

mediatek

mt6765
mt6771
mt8168
mt8766
mt6873
mt6833
mt6769
mt8788
mt8365
mt6891
mt6875
mt6877
mt6785
mt6739
mt8666
mt8768
mt8667
mt6580
mt6761
mt8696

google

android

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2022-20066", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2022-04-11T20:15:18.877", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/May-2022", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729."}, {"lang": "es", "value": "En atf (hwfde), se presenta un posible filtrado de informaci\u00f3n confidencial debido a un manejo incorrecto de errores. Esto podr\u00eda conllevar a una divulgaci\u00f3n de informaci\u00f3n local con los privilegios de ejecuci\u00f3n System requeridos. No es requerida una interacci\u00f3n del usuario para su explotaci\u00f3n. ID del Parche: ALPS06171729; ID de Incidencia: ALPS06171729"}], "lastModified": "2022-09-09T16:47:51.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64"}, {"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6580:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "46F71838-4E50-4F2A-9EB8-30AE5DF8511E"}, {"criteria": "cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}, {"criteria": "cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F726F486-A86F-4215-AD93-7A07A071844A"}, {"criteria": "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}, {"criteria": "cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D23991D5-1893-49F4-8A06-D5E66C96C3B3"}, {"criteria": "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BE4D2AED-C713-407F-A34A-52C3D8F65835"}, {"criteria": "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A82E0A4F-072F-474C-B94C-8114ABE05639"}, {"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39"}, {"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}, {"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}, {"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}, {"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}, {"criteria": "cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3CE2FC35-716A-4706-97BA-5DB165041580"}, {"criteria": "cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "97C76F98-5D8D-4E52-ABAF-CD27C1205B0E"}, {"criteria": "cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}, {"criteria": "cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2FE14B46-C1CA-465F-8578-059FA2ED30EB"}, {"criteria": "cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "26573298-76BC-49FE-8D99-CF03ED01B185"}, {"criteria": "cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CE45F606-2E75-48BC-9D1B-99D504974CBF"}, {"criteria": "cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}, {"criteria": "cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FE10C121-F2AD-43D2-8FF9-A6C197858220"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}