CVE-2022-21777: High severity android vulnerability

Published Jul 6, 2022

Updated

In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issue ID: ALPS06713894.

Affected Software

43 affected components

Google Android=11.0

Google Android=12.0

MediaTek Mt6580

MediaTek Mt6735

MediaTek Mt6739

MediaTek Mt6761

MediaTek Mt6765

MediaTek Mt6768

MediaTek Mt6771

MediaTek Mt6779

MediaTek Mt6785

MediaTek Mt6833

MediaTek Mt6853

MediaTek Mt6873

MediaTek Mt6875

MediaTek Mt6877

MediaTek Mt6879

MediaTek Mt6885

MediaTek Mt6891

MediaTek Mt6893

MediaTek Mt6895

MediaTek Mt6983

MediaTek Mt8167

MediaTek Mt8167s

MediaTek Mt8168

MediaTek Mt8173

MediaTek Mt8175

MediaTek Mt8185

MediaTek Mt8321

MediaTek Mt8362a

MediaTek Mt8365

MediaTek Mt8385

MediaTek Mt8666

MediaTek Mt8667

MediaTek Mt8675

MediaTek Mt8765

MediaTek Mt8766

MediaTek Mt8768

MediaTek Mt8786

MediaTek Mt8788

MediaTek Mt8789

MediaTek Mt8791

MediaTek Mt8797

Event History

Jul 6, 2022

CVE Published

via MITRE·01:07 PM

Data Sourced

via MITRE·01:07 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-21777?

CVE-2022-21777 has a medium severity rating as it allows local escalation of privilege due to a permission bypass.

How do I fix CVE-2022-21777?

To fix CVE-2022-21777, apply the software patch identified as ALPS06713894.

Which software versions are affected by CVE-2022-21777?

CVE-2022-21777 affects Google Android versions 11.0 and 12.0.

Who can exploit CVE-2022-21777?

CVE-2022-21777 can be exploited by an attacker with local access, requiring no additional execution privileges or user interaction.

What is the impact of not addressing CVE-2022-21777?

Failing to address CVE-2022-21777 could result in unauthorized access and potential control over affected devices.