CVE-2023-32845 — HIGH (7.5)

Vulnerability Description

In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01128524; Issue ID: MOLY01139296 (MSV-860).

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Mediatek	Nr15	-
Mediatek	Nr16	-
Mediatek	Nr17	-
Mediatek	Mt2735	-
Mediatek	Mt2737	-
Mediatek	Mt6297	-
Mediatek	Mt6298	-
Mediatek	Mt6813	-
Mediatek	Mt6815	-
Mediatek	Mt6833	-
Mediatek	Mt6835	-
Mediatek	Mt6853	-
Mediatek	Mt6855	-
Mediatek	Mt6873	-
Mediatek	Mt6875	-
Mediatek	Mt6875T	-
Mediatek	Mt6877	-
Mediatek	Mt6879	-
Mediatek	Mt6880	-
Mediatek	Mt6883	-

Related Weaknesses (CWE)

CWE-617

References

https://corp.mediatek.com/product-security-bulletin/December-2023Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/December-2023Vendor Advisory

FAQ

What is CVE-2023-32845?

CVE-2023-32845 is a vulnerability with a CVSS score of 7.5 (HIGH). In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges...

How severe is CVE-2023-32845?

CVE-2023-32845 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-32845?

Check the references section above for vendor advisories and patch information. Affected products include: Mediatek Nr15, Mediatek Nr16, Mediatek Nr17, Mediatek Mt2735, Mediatek Mt2737.