CVE-2023-20796 — MEDIUM (4.4)

Vulnerability Description

In power, there is a possible memory corruption due to an incorrect bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07929790; Issue ID: ALPS07929790.

CVSS Score

4.4

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Linuxfoundation	Yocto	2.6
Rdkcentral	Rdk-B	2022q3
Google	Android	12.0
Openwrt	Openwrt	19.07.0
Mediatek	Mt2735	-
Mediatek	Mt2737	-
Mediatek	Mt6789	-
Mediatek	Mt6833	-
Mediatek	Mt6835	-
Mediatek	Mt6853	-
Mediatek	Mt6855	-
Mediatek	Mt6873	-
Mediatek	Mt6877	-
Mediatek	Mt6879	-
Mediatek	Mt6880	-
Mediatek	Mt6886	-
Mediatek	Mt6890	-
Mediatek	Mt6893	-
Mediatek	Mt6895	-
Mediatek	Mt6980	-

Related Weaknesses (CWE)

CWE-787

References

https://corp.mediatek.com/product-security-bulletin/August-2023Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/August-2023Vendor Advisory

FAQ

What is CVE-2023-20796?

CVE-2023-20796 is a vulnerability with a CVSS score of 4.4 (MEDIUM). In power, there is a possible memory corruption due to an incorrect bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for...

How severe is CVE-2023-20796?

CVE-2023-20796 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-20796?

Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Yocto, Rdkcentral Rdk-B, Google Android, Openwrt Openwrt, Mediatek Mt2735.