CVE-2022-20108

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330702; Issue ID: DTV03330702.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MediaTek, Inc.MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT9256, MT9266, MT9269, MT9285, MT9286, MT9288, MT9600, MT9602, MT9610, MT9611, MT9612, MT9613, MT9615, MT9617, MT9629, MT9630, MT9631, MT9632, MT9636, Android 9.0, 10.0, 11.0 or Linux Kernel 4.9, 4.19

References

Timeline

Published
May 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-201097.8In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with CVE-2022-20118.8Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2022-201107.0In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execCVE-2022-201118.4In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additioCVE-2022-201125.5In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings dueCVE-2022-201137.8In mPreference of DefaultUsbConfigurationPreferenceController.java, there is a possible way to enable file transfer mode due to a logic erroCVE-2022-201147.8In placeCall of TelecomManager.java, there is a possible way for an application to keep itself running with foreground service importance duCVE-2022-201155.5In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permisCVE-2022-201167.8In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection. This could lead tCVE-2022-201175.5In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to locaCVE-2022-201187.0In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalationCVE-2022-201195.5In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local