IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.5Mittel

CVE-2023-20850

MediaTek, Inc. MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781; linuxfoundation yocto; mediatek iot_yocto; google android Veröffentlicht: (vor 3 Jahren)

Beschreibung

In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340381.

Schwachstellentyp (CWE): CWE-787

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
google android 11.0
linux linux_kernel 6.1
linuxfoundation yocto 4.0
mediatek iot_yocto 23.0
MediaTek, Inc. MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Android 11.0, 12.0 / Linux 6.1 / IOT-v23.0 / Yocto 4.0

Referenzen und Patches

Neue CVEs im selben Produkt — Android

6.7Mittel
CVE-2026-58977
Google Android

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

7.8Hoch
CVE-2026-58930
Google Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, injec…

6.7Mittel
CVE-2026-58927
Google Android

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a …

2.5Niedrig
CVE-2026-58926
Google Android

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacke…

7.8Hoch
CVE-2026-58925
Google Android

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigg…

7.5Hoch
CVE-2026-58924
Google Android

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within th…