Check Point Research (CPR), a cyber threat intelligence group, has provided information about a vulnerability it discovered. The vulnerability was found in phones powered by the Unisoc Tiger T700 SoC. While you may not be familiar with the processor, it powers a number of Motorola phones, including the Motorola Moto G20, Moto E30, and Moto E40.
See also: Apple introduces Rapid Security Response for iOS and macOS
Before its findings, Check Point Research had not found any listings of vulnerabilities in Unisoc products. But by inspecting the baseband of Unison's SoC, it was able to find a way to remotely attack devices. The vulnerability would allow an attacker to stop modem services and, even worse, stop all communications on affected phones
See also: QBot malware and Black Basta ransomware collaborate and target companies
Basically, a bad data packet is sent to the Unisoc device and when the modem receives that data, the modem crashes. When this happens, the attacker can launch a Denial of Service (DoS) or Remote Code Execution (RCE) attack. While devices with the Unisoc Tiger T700 SoC are currently vulnerable, this will not be the case for long.
CPR reported the vulnerability to Unisoc in May 2022. The company acknowledged the vulnerability, rating it as critical. The company has since released a patch for the vulnerability.
See also: Mandiant: “There was no evidence” of LockBit ransomware hack
Unisoc had issues with its chips in March, when dozens of low-end smartphones were compromised due to Unisoc's base processor, the SC9863A. As mentioned above, the new vulnerability currently affects phones with the Unisoc Tiger T700 SoC, which can be found in smartphones like the Motorola Moto G20, Moto E30, and Moto E40.
Chip-level vulnerabilities of varying severity are constantly being discovered and are constantly making their way through the repair chain. This is just a reminder that you don't have to be afraid to buy a phone with a Unisoc chip just because it has a Unisoc chip — the company seems to be constantly working to patch vulnerabilities.
Information source: xda-developers.com
