CVE-2024-20020

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

I

n OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08522504; Issue ID: ALPS08522504.

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/March-2024	Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/March-2024	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt2713:-:::::::*
	cpe:2.3:h:mediatek:mt2715:-:::::::*
	cpe:2.3:h:mediatek:mt8173:-:::::::*
	cpe:2.3:h:mediatek:mt8188:-:::::::*
	cpe:2.3:h:mediatek:mt8195:-:::::::*
	cpe:2.3:h:mediatek:mt8390:-:::::::*
	cpe:2.3:h:mediatek:mt8395:-:::::::*

History

30 Jan 2025, 15:07

Type	Values Removed	Values Added
CPE		cpe:2.3:h:mediatek:mt8173:-:::::::* cpe:2.3:o:google:android:13.0:-:::::: cpe:2.3:h:mediatek:mt8195:-:::::::* cpe:2.3:h:mediatek:mt2713:-:::::::* cpe:2.3:h:mediatek:mt2715:-:::::::* cpe:2.3:h:mediatek:mt8390:-:::::::* cpe:2.3:h:mediatek:mt8395:-:::::::* cpe:2.3:h:mediatek:mt8188:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.4
References	~~() https://corp.mediatek.com/product-security-bulletin/March-2024 -~~	() https://corp.mediatek.com/product-security-bulletin/March-2024 - Vendor Advisory
CWE		CWE-787
First Time		Mediatek mt8188 Mediatek mt2715 Google android Mediatek mt8173 Mediatek Mediatek mt8390 Mediatek mt8195 Google Mediatek mt2713 Mediatek mt8395

21 Nov 2024, 08:51

Type	Values Removed	Values Added
References	~~() https://corp.mediatek.com/product-security-bulletin/March-2024 -~~	() https://corp.mediatek.com/product-security-bulletin/March-2024 -

Information

Published : 2024-03-04 03:15

Updated : 2025-03-28 20:15

NVD link : CVE-2024-20020

Mitre link : CVE-2024-20020

CVE.ORG link : CVE-2024-20020

JSON object : View

Products Affected

android

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-20020", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2024-03-04T03:15:07.107", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08522504; Issue ID: ALPS08522504."}, {"lang": "es", "value": "En OPTEE, existe una posible escritura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites incorrecta. Esto podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n local con privilegios de ejecuci\u00f3n de System necesarios. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n. ID de parche: ALPS08522504; ID del problema: ALPS08522504."}], "lastModified": "2025-03-28T20:15:20.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08A26AC2-409E-499A-B0D5-8C2B5038947D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt2713:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7D1135F9-E38C-4308-BD32-A4D83959282E"}, {"criteria": "cpe:2.3:h:mediatek:mt2715:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FA252F20-1BB7-4654-972C-F257F37396A7"}, {"criteria": "cpe:2.3:h:mediatek:mt8173:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4452EFCF-5733-40A0-8726-F8E33E569411"}, {"criteria": "cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BA3D4A45-38EE-4125-AE67-89D1C707F95A"}, {"criteria": "cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ED210E64-6CE7-42B1-849E-68C0E22521F6"}, {"criteria": "cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B774B7D7-B7DD-43A0-833F-7E39DF82CA60"}, {"criteria": "cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}