Hero Banner DESKTOP 1920X677

    January 2024
    Product Security Bulletin

    Published 2024-01-02 | Updated 2024-03-19

    The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.

    The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).

    The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.

    The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).

    Summary

    Severity CVEs
    High CVE-2023-32872, CVE-2023-32874, CVE-2023-32890
    Medium CVE-2023-32875, CVE-2023-32876, CVE-2023-32877, CVE-2023-32878, CVE-2023-32879, CVE-2023-32880, CVE-2023-32881, CVE-2023-32882, CVE-2023-32883, CVE-2023-32884, CVE-2023-32885, CVE-2023-32886, CVE-2023-32887, CVE-2023-32888, CVE-2023-32889, CVE-2023-32831, CVE-2023-32891

    Details

    CVE CVE-2023-32872
    Title Out-of-bounds write in keyInstall
    Severity High
    Vulnerability Type EoP
    CWE CWE-787 Out-of-bounds Write
    Description In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8185, MT8321, MT8385, MT8666, MT8667, MT8673, MT8675, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798
    Affected Software Versions Android 11.0, 12.0, 13.0
    Report Source External

    CVE CVE-2023-32874
    Title Out-of-bounds write in Modem IMS Stack
    Severity High
    Vulnerability Type RCE
    CWE CWE-787 Out-of-bounds Write
    Description In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2735, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990
    Affected Software Versions Modem LR13 NR15, NR16, and NR17
    Report Source External

    CVE CVE-2023-32890
    Title Null pointer dereference in Modem EMM
    Severity High
    Vulnerability Type DoS
    CWE CWE-476 NULL Pointer Dereference
    Description In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2731, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT8786
    Affected Software Versions Modem LR12A
    Report Source External

    CVE CVE-2023-32875
    Title Out-of-bounds read in keyInstall
    Severity Medium
    Vulnerability Type ID
    CWE CWE-125 Out-of-bounds Read
    Description In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8185, MT8321, MT8385, MT8666, MT8667, MT8673, MT8675, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798
    Affected Software Versions Android 11.0, 12.0, 13.0
    Report Source External

    CVE CVE-2023-32876
    Title Out-of-bounds read in keyInstall
    Severity Medium
    Vulnerability Type ID
    CWE CWE-125 Out-of-bounds Read
    Description In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8185, MT8321, MT8385, MT8666, MT8667, MT8673, MT8675, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798
    Affected Software Versions Android 11.0, 12.0, 13.0
    Report Source External

    CVE CVE-2023-32877
    Title Out-of-bounds write in battery
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-787 Out-of-bounds Write
    Description In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32878
    Title Out-of-bounds read in battery
    Severity Medium
    Vulnerability Type ID
    CWE CWE-125 Out-of-bounds Read
    Description In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32879
    Title Out-of-bounds write in battery
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-787 Out-of-bounds Write
    Description In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32880
    Title Out-of-bounds read in battery
    Severity Medium
    Vulnerability Type ID
    CWE CWE-125 Out-of-bounds Read
    Description In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32881
    Title Integer overflow or wraparound in battery
    Severity Medium
    Vulnerability Type ID
    CWE CWE-190 Integer Overflow or Wraparound
    Description In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32882
    Title Out-of-bounds write in battery
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-787 Out-of-bounds Write
    Description In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT6983, MT8167, MT8168, MT8188, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32883
    Title Out-of-bounds write in Engineer Mode
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-787 Out-of-bounds Write
    Description In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT2713, MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395, MT8666, MT8667, MT8673, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32884
    Title Information disclosure in netdagent
    Severity Medium
    Vulnerability Type ID
    CWE CWE-787 Information Disclosure
    Description In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT2713, MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8188, MT8192, MT8195, MT8195Z, MT8321, MT8362A, MT8365, MT8385, MT8395, MT8666, MT8667, MT8673, MT8696, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8795T, MT8797, MT8798, MT8871
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32885
    Title Improper restriction of operations within the bounds of a memory buffer in display drm
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
    Description In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8188, MT8195, MT8766, MT8768, MT8781, MT8789, MT8791T, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    CVE CVE-2023-32886
    Title Out-of-bounds write in Modem IMS SMS UA
    Severity Medium
    Vulnerability Type DoS
    CWE CWE-787 Out-of-bounds Write
    Description In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990, MT8673, MT8675, MT8676, MT8791, MT8791T, MT8792, MT8796, MT8797, MT8798
    Affected Software Versions Modem NR15, NR16, and NR17
    Report Source Internal

    CVE CVE-2023-32887
    Title Stack-based buffer overflow in Modem IMS Stack
    Severity Medium
    Vulnerability Type DoS
    CWE CWE-121 Stack-based Buffer Overflow
    Description In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990
    Affected Software Versions Modem NR15, NR16, and NR17
    Report Source External

    CVE CVE-2023-32888
    Title Out-of-bounds write in Modem IMS Call UA
    Severity Medium
    Vulnerability Type DoS
    CWE CWE-787 Out-of-bounds Write
    Description In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990
    Affected Software Versions Modem NR15, NR16, and NR17
    Report Source External

    CVE CVE-2023-32889
    Title Out-of-bounds write in Modem IMS Call UA
    Severity Medium
    Vulnerability Type DoS
    CWE CWE-787 Out-of-bounds Write
    Description In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990
    Affected Software Versions Modem NR15, NR16, and NR17
    Report Source External

    CVE CVE-2023-32831
    Title Use of insufficiently random values in wlan driver
    Severity Medium
    Vulnerability Type ID
    CWE CWE-330 Use of Insufficiently Random Values
    Description In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation.
    Affected Chipsets MT6890, MT7612, MT7613, MT7615, MT7622, MT7626, MT7629, MT7915, MT7916, MT7981, MT7986
    Affected Software Versions SDK version 7.6.7.1 and before
    Report Source External

    CVE CVE-2023-32891
    Title Improper input validation in bluetooth service
    Severity Medium
    Vulnerability Type EoP
    CWE CWE-20 Improper Input Validation
    Description In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
    Affected Chipsets MT2713, MT6739, MT6761, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6983, MT6985, MT6989, MT8167, MT8167S, MT8173, MT8175, MT8188, MT8195, MT8321, MT8365, MT8370, MT8385, MT8390, MT8395, MT8765, MT8766, MT8768, MT8786, MT8797, MT8798
    Affected Software Versions Android 12.0, 13.0
    Report Source External

    Vulnerability Type Definition

    Abbreviation Definition
    RCE Remote Code Execution
    EoP Elevation of Privilege
    ID Information Disclosure
    DoS Denial of Service
    N/A Classification not available

    Versions

    Version Date Description
    1.0 January 2, 2024 Bulletin published.
    1.1 March 19, 2024 CVE table updated.
    1.2 January 10, 2025 Report Source information has been added to all the CVEs.

    Notes

    Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.

    If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.

    Notes

    Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.
    If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.