CVE-2022-21766: Mediatek CCCI Kernel Driver Stack Buffer Overflow

We have identified a new stack buffer overflow vulnerability in Mediatek’s Linux Kernel driver implementation of cellular-to-application processor communication interface (CCCI). The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in the Linux Kernel.
The vulnerability we are disclosing in this advisory affected a wide range of Mediatek devices, including phones on the newest chipsets (Dimensity 700, 1000, etc). The July 2022 issue of the Mediatek Security Bulletin contains this vulnerability as CVE-2022-21766. …

advisory application arbitrary code baseband buffer buffer overflow buffer overflow vulnerability cellular code code execution communication compromised cve driver exploited implementation interface kernel kernel driver linux linux kernel malicious mediatek overflow processor runtime stack vulnerability