CVE-2022-32636

Vulnerability

In keyinstall, an integer overflow leads to a possible out-of-bounds write. This vulnerability affects MediaTek chipsets including MT6580, MT6735, MT6739, MT6753, MT6757, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6891, MT6893, MT6895, among others [1]. The issue is present in software versions prior to the patch identified by ALPS07510064.

Exploitation

An attacker requires System execution privileges to trigger the integer overflow and subsequent out-of-bounds write. User interaction is not needed for exploitation. The precise steps involve leveraging the overflow within keyinstall to write data beyond the allocated buffer bounds.

Impact

Successful exploitation leads to local escalation of privilege (EoP). The attacker can achieve arbitrary code execution at the System level, fully compromising the affected device's integrity, confidentiality, and availability.

Mitigation

MediaTek released a security patch in January 2023, identified as ALPS07510064 [1]. Device OEMs were notified at least two months prior to publication. Users should apply the update from their device manufacturer as soon as it becomes available. No workaround is documented.