CVE-2022-21765: Mediatek CCCI Kernel Driver OOB Write

We have identified a new out-of-bound write vulnerability in Mediatek’s Linux Kernel driver implementation of cellular-to-application processor communication interface (CCCI). The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in the Linux Kernel.
The vulnerability we are disclosing in this advisory affected a wide range of Mediatek devices, including phones on the newest chipsets (Dimensity 700, 1000, etc). The July 2022 issue of the Mediatek Security Bulletin contains this vulnerability as CVE-2022-21765.
Vulnerability …

advisory application arbitrary code baseband cellular code code execution communication compromised cve driver exploited implementation interface kernel kernel driver linux linux kernel malicious mediatek oob processor runtime vulnerability