CVE-2023-32805

In power, there is a possible out of bounds write due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08102892; Issue ID: ALPS08102892.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.6 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/September-2023	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:google:android:11.0:::::::*
	cpe:2.3:o:google:android:12.0:::::::*

OR	cpe:2.3:h:mediatek:mt8168:-:::::::*
	cpe:2.3:h:mediatek:mt8675:-:::::::*

History

07 Sep 2023, 19:10

Type	Values Removed	Values Added
References	~~(MISC) https://corp.mediatek.com/product-security-bulletin/September-2023 -~~	(MISC) https://corp.mediatek.com/product-security-bulletin/September-2023 - Vendor Advisory
First Time		Mediatek mt8675 Mediatek mt8168 Mediatek Google Google android
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:h:mediatek:mt8675:-:::::::* cpe:2.3:o:google:android:11.0:::::::* cpe:2.3:o:google:android:12.0:::::::* cpe:2.3:h:mediatek:mt8168:-:::::::*
CWE		CWE-787

04 Sep 2023, 03:51

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-04 03:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-32805

Mitre link : CVE-2023-32805

CVE.ORG link : CVE-2023-32805

JSON object : View

Products Affected

mediatek

mt8675
mt8168

google

android

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2023-32805", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.6}]}, "published": "2023-09-04T03:15:12.140", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/September-2023", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In power, there is a possible out of bounds write due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08102892; Issue ID: ALPS08102892."}, {"lang": "es", "value": "En power, existe una posible escritura fuera de l\u00edmites debido a un valor predeterminado inseguro. Esto podr\u00eda conducir a una escalada local de privilegios con privilegios de ejecuci\u00f3n del sistema necesarios. Se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: ALPS08102892; ID del problema: ALPS08102892."}], "lastModified": "2023-09-07T19:10:30.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64"}, {"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3CE2FC35-716A-4706-97BA-5DB165041580"}, {"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}