by Kastro
Paper/Archive/CVE-2024-20078

CVE-2024-20078

MediaTek, Inc. MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798 — In venc, there is a possible out of bounds write due to type confusion.

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 17.9.179 × 203.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08737250; Issue ID: MSV-1452.

Affected

ProductAffectedFixed inSource
MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798Android 12.0, 13.0, 14.0–CNA
mt6768-–CISA-ADP
mt6779-–CISA-ADP
mt8321-–CISA-ADP
mt8385-–CISA-ADP
mt8755-–CISA-ADP
mt8765-–CISA-ADP
mt8766-–CISA-ADP
mt8768-–CISA-ADP
mt8771-–CISA-ADP
mt8775-–CISA-ADP
mt8781-–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcorp.mediatek.com/product-security-bulletin/July-2024