CVE-2024-20143
What it is
In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2069.
At a glance
- Exploitability
- Can be exploited with physical access without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 0.1% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.1% · EPSS, next 30 days
- Weakness
- CWE-787 · Out-of-bounds write
- Record status
- Analyzed
Affected
- Linuxfoundation Yocto 4.0
- Rdkcentral rdk-b 2022q3
- Rdkcentral rdk-b 2024q1
- Google Android 12.0
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0
- Openwrt 19.07.0
Attack profile CVSS 3.1 · 6.6
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
