CVE-2022-32619

Vulnerability

In keyinstall, a buffer copy operation lacks proper size validation (CWE-120), resulting in an out-of-bounds write due to an incorrect bounds check [1]. The vulnerability affects a wide range of MediaTek chipsets including MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, and others [1]. System execution privileges are required to reach the vulnerable code path.

Exploitation

An attacker with System execution privileges can trigger the out-of-bounds write by invoking the keyinstall functionality. No user interaction is needed for exploitation [1]. The exact sequence of steps is not detailed in the available references, but the attacker must have already obtained System-level access on the device.

Impact

Successful exploitation leads to local escalation of privilege (EoP) [1]. While the attacker already has System privileges, the out-of-bounds write may allow further elevation within the system, potentially compromising additional security boundaries.

Mitigation

MediaTek has released a patch identified as ALPS07439659 [1]. Device OEMs were notified at least two months prior to the December 2022 publication date and are expected to distribute the fix through their security update processes. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.