CVE-2023-20746

MEDIUM

iot-yocto - Local Privilege Escalation via Improper Locking in vcu

Title source: llm

Description

In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Issue ID: ALPS07519217.

References (1)

Core 1

Core References

Vendor Advisory

https://corp.mediatek.com/product-security-bulletin/June-2023

Scores

CVSS v3 6.7

EPSS 0.0003

EPSS Percentile 8.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-667

Status published

Products (4)

google/android 12.0

google/android 13.0

linuxfoundation/iot-yocto 22.2

linuxfoundation/yocto 4.0

Published Jun 06, 2023

Tracked Since Feb 18, 2026