May 2024
Product Security Bulletin
Published 2024-05-06
The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.
The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).
The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.
The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).
Summary
| Severity | CVEs |
|---|---|
| High | CVE-2024-20056, CVE-2024-20057, CVE-2023-32873, CVE-2023-32871 |
| Medium | CVE-2024-20058, CVE-2024-20059, CVE-2024-20060, CVE-2024-20064, CVE-2023-24023, CVE-2024-20021 |
Details
| CVE | CVE-2024-20056 |
|---|---|
| Title | Improper input validation in preloader |
| Severity | High |
| Vulnerability Type | EoP |
| CWE | CWE-20 Improper Input Validation |
| Description | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6880, MT6885, MT6886, MT6890, MT6893, MT6895, MT6897, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676, MT8678 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 / OpenWRT 19.07, 21.02, 23.05 / RDK-B 2022q3 |
| Report Source | Internal |
| CVE | CVE-2024-20057 |
|---|---|
| Title | Out-of-bounds write in keyInstall |
| Severity | High |
| Vulnerability Type | EoP |
| CWE | CWE-787 Out-of-bounds Write |
| Description | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | Internal |
| CVE | CVE-2023-32873 |
|---|---|
| Title | Out-of-bounds write in keyInstall |
| Severity | High |
| Vulnerability Type | EoP |
| CWE | CWE-787 Out-of-bounds Write |
| Description | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6761, MT6765, MT6768, MT6833, MT6853, MT6855, MT6893, MT6895, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | External |
| CVE | CVE-2023-32871 |
|---|---|
| Title | Unchecked error condition in DA |
| Severity | High |
| Vulnerability Type | EoP |
| CWE | CWE-391 Unchecked Error Condition |
| Description | In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| Affected Chipsets | MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6893, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395, MT8755, MT8765, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798 |
| Affected Software Versions | Android 11.0, 12.0, 13.0, 14.0 / OpenWrt 19.07, 21.02 / Yocto 3.3, 4.0 / RDK-B 22Q3 |
| Report Source | Internal |
| CVE | CVE-2024-20058 |
|---|---|
| Title | Out-of-bounds read in keyInstall |
| Severity | Medium |
| Vulnerability Type | ID |
| CWE | CWE-125 Out-of-bounds Read |
| Description | In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6765, MT6768, MT6785, MT6833, MT6853, MT6855, MT6893, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | Internal |
| CVE | CVE-2024-20059 |
|---|---|
| Title | Improper handling of faults that lead to instruction skips in da |
| Severity | Medium |
| Vulnerability Type | EoP |
| CWE | CWE-1332 Improper Handling of Faults that Lead to Instruction Skips |
| Description | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT6989, MT8188, MT8370, MT8390 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | Internal |
| CVE | CVE-2024-20060 |
|---|---|
| Title | Improper handling of faults that lead to instruction skips in da |
| Severity | Medium |
| Vulnerability Type | EoP |
| CWE | CWE-1332 Improper Handling of Faults that Lead to Instruction Skips |
| Description | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT6989, MT8188, MT8370, MT8390 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | Internal |
| CVE | CVE-2024-20064 |
|---|---|
| Title | Improper input validation in wlan service |
| Severity | Medium |
| Vulnerability Type | EoP |
| CWE | CWE-20 Improper Input Validation |
| Description | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6580, MT6761, MT6762, MT6768, MT6781, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT6989, MT8678, MT8755, MT8775, MT8792, MT8796 |
| Affected Software Versions | Android 13.0, 14.0 |
| Report Source | External |
| CVE | CVE-2023-24023 |
|---|---|
| Title | Improper verification of cryptographic signature in bluetooth service |
| Severity | Medium |
| Vulnerability Type | EoP |
| CWE | CWE-347 Improper Verification of Cryptographic Signature |
| Description | In bluetooth service, there is a possible reduction of key strengths due to insufficient validation of cryptographic parameters. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| Affected Chipsets | MT7933 |
| Affected Software Versions | SDK version 3.1 and before |
| Report Source | Internal |
| CVE | CVE-2024-20021 |
|---|---|
| Title | Improper privilege management in atf spm |
| Severity | Medium |
| Vulnerability Type | EoP |
| CWE | CWE-269 Improper Privilege Management |
| Description | In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. |
| Affected Chipsets | MT6768, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8168, MT8183, MT8188, MT8188T, MT8195, MT8195Z, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8666A, MT8666B, MT8667, MT8673, MT8675, MT8675, MT8676, MT8678, MT8765, MT8766, MT8766Z, MT8768, MT8768A, MT8768B, MT8768T, MT8768Z, MT8781, MT8781, MT8786, MT8788, MT8788T, MT8788, MT8788X, MT8788Z, MT8792, MT8795T, MT8796, MT8798 |
| Affected Software Versions | Android 12.0, 13.0, 14.0 |
| Report Source | External |
Vulnerability Type Definition
| Abbreviation | Definition |
|---|---|
| RCE | Remote Code Execution |
| EoP | Elevation of Privilege |
| ID | Information Disclosure |
| DoS | Denial of Service |
| N/A | Classification not available |
Versions
| Version | Date | Description |
| 1.0 | May 6, 2024 | Bulletin published. |
| 1.1 | January 10, 2025 | Report Source information has been added to all the CVEs. |
Notes
Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.
If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.
Notes
Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.
If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.
If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.