CVE-2022-20093
📋 TL;DR
This vulnerability in MediaTek telephony components allows local attackers to disable SMS message reception without proper permission checks. It enables local privilege escalation without requiring user interaction or additional execution privileges. Affects devices using vulnerable MediaTek chipsets.
💻 Affected Systems
- MediaTek chipset-based smartphones and devices
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access or malicious app could permanently disable SMS functionality, potentially interfering with two-factor authentication, emergency alerts, and communication services.
Likely Case
Malicious apps could silently disable SMS reception, preventing users from receiving important messages including security codes and notifications.
If Mitigated
With proper app sandboxing and permission controls, exploitation would be limited to apps with telephony permissions.
🎯 Exploit Status
Exploitation requires local access or malicious app installation. No user interaction needed once app is installed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware with patch ID ALPS06498868
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/May-2022
Restart Required: Yes
Instructions:
1. Check with device manufacturer for firmware updates. 2. Apply MediaTek-provided patch ALPS06498868. 3. Reboot device after update.
🔧 Temporary Workarounds
Restrict app permissions
androidReview and restrict telephony permissions for non-essential apps
Disable unknown sources
androidPrevent installation of apps from unknown sources to reduce attack surface
🧯 If You Can't Patch
- Monitor for suspicious apps requesting telephony permissions
- Implement mobile device management with app whitelisting
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against manufacturer's patched versions. Look for patch ALPS06498868 in system updates.Check Version:
Settings > About Phone > Build Number (varies by device)Verify Fix Applied:
Verify firmware version includes patch ALPS06498868. Test SMS reception functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual telephony permission requests
- SMS service disruption logs
Network Indicators:
- SMS delivery failures without network issues
SIEM Query:
android.permission.*telephony OR sms_failure AND NOT network_issue