PT-2022-2825 · Unisoc+1 · Unisoc+1

Published 2022-03-21 · Updated 2022-06-24 · CVE-2022-20210

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android SoC versions (affected versions not specified)

Description The issue is related to a bug in the parsing code of NAS messages, which could be exploited by an attacker to remotely crash the modem, potentially leading to denial of service (DoS) or remote code execution (RCE). The vulnerability is associated with a buffer overflow in the memory of Unisoc microprogrammed software for 2/3/4/5G devices. An attacker could exploit this by sending specially crafted malicious packets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-03369

CVE-2022-20210

Affected Products

Android

Unisoc

References · 14

• https://bdu.fstec.ru/vul/2022-03369 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20210 · Security Note
• https://source.android.com/security/bulletin/2022-06-01 · Vendor Advisory
• https://t.me/cvenotify/32080 · Telegram Post
• https://t.me/true_secator/3038 · Telegram Post
• https://blog.checkpoint.com/2022/06/02/check-point-research-unveils-vulnerability-within-unisoc-baseband-chipset · Note
• https://astera.ru/news/cpr-uyazvimost-unisoc-pozvolyala-hakeram-udalenno-otklyuchit-svyaz-na-smartfonah · Note
• https://securitylab.ru/news/532078.php · Note
• https://br.atsit.in/ru/?p=198331 · Note
• https://t.me/poxek/1706 · Telegram Post
• https://4pda.to/2022/06/03/400287/v_chipakh_unisoc_najdena_krupnaya_uyazvimost · Note
• https://bleepingcomputer.com/news/security/android-june-2022-updates-bring-fix-for-critical-rce-vulnerability · Note
• https://securityweek.com/google-patches-critical-android-vulnerabilities-june-2022-updates · Note
• https://t.me/true_secator/3017 · Telegram Post