May 2024 Product Security Bulletin

Published 2024-05-06
The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.

The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).


Summary

Severity CVEs
High CVE-2024-20056, CVE-2024-20057, CVE-2023-32873, CVE-2023-32871
Medium CVE-2024-20058, CVE-2024-20059, CVE-2024-20060, CVE-2024-20064, CVE-2023-24023, CVE-2024-20021


Details

CVE CVE-2024-20056
Title Improper input validation in preloader
Severity High
Vulnerability Type EoP
CWE CWE-20 Improper Input Validation
Description In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6880, MT6885, MT6886, MT6890, MT6893, MT6895, MT6897, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676, MT8678
Affected Software Versions Android 12.0, 13.0, 14.0 / OpenWRT 19.07, 21.02, 23.05 / RDK-B 2022q3

CVE CVE-2024-20057
Title Out-of-bounds write in keyInstall
Severity High
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796
Affected Software Versions Android 12.0, 13.0, 14.0

CVE CVE-2023-32873
Title Out-of-bounds write in keyInstall
Severity High
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6833, MT6853, MT6855, MT6893, MT6895, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796
Affected Software Versions Android 12.0, 13.0, 14.0

CVE CVE-2023-32871
Title Unchecked error condition in DA
Severity High
Vulnerability Type EoP
CWE CWE-391 Unchecked Error Condition
Description In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6893, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395, MT8755, MT8765, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798
Affected Software Versions Android 11.0, 12.0, 13.0, 14.0 / OpenWrt 19.07, 21.02 / Yocto 3.3, 4.0 / RDK-B 22Q3

CVE CVE-2024-20058
Title Out-of-bounds read in keyInstall
Severity Medium
Vulnerability Type ID
CWE CWE-125 Out-of-bounds Read
Description In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6765, MT6768, MT6785, MT6833, MT6853, MT6855, MT6893, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798
Affected Software Versions Android 12.0, 13.0, 14.0

CVE CVE-2024-20059
Title Improper handling of faults that lead to instruction skips in da
Severity Medium
Vulnerability Type EoP
CWE CWE-1332 Improper Handling of Faults that Lead to Instruction Skips
Description In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT6989, MT8188, MT8370, MT8390
Affected Software Versions Android 12.0, 13.0, 14.0

CVE CVE-2024-20060
Title Improper handling of faults that lead to instruction skips in da
Severity Medium
Vulnerability Type EoP
CWE CWE-1332 Improper Handling of Faults that Lead to Instruction Skips
Description In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT6989, MT8188, MT8370, MT8390
Affected Software Versions Android 12.0, 13.0, 14.0

CVE CVE-2024-20064
Title Improper input validation in wlan service
Severity Medium
Vulnerability Type EoP
CWE CWE-20 Improper Input Validation
Description In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6580, MT6761, MT6762, MT6768, MT6781, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT6989, MT8678, MT8755, MT8775, MT8792, MT8796
Affected Software Versions Android 13.0, 14.0

CVE CVE-2023-24023
Title Improper verification of cryptographic signature in bluetooth service
Severity Medium
Vulnerability Type EoP
CWE CWE-347 Improper Verification of Cryptographic Signature
Description In bluetooth service, there is a possible reduction of key strengths due to insufficient validation of cryptographic parameters. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT7933
Affected Software Versions SDK version 3.1 and before

CVE CVE-2024-20021
Title Improper privilege management in atf spm
Severity Medium
Vulnerability Type EoP
CWE CWE-269 Improper Privilege Management
Description In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6768, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8168, MT8183, MT8188, MT8188T, MT8195, MT8195Z, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8666A, MT8666B, MT8667, MT8673, MT8675, MT8675, MT8676, MT8678, MT8765, MT8766, MT8766Z, MT8768, MT8768A, MT8768B, MT8768T, MT8768Z, MT8781, MT8781, MT8786, MT8788, MT8788T, MT8788, MT8788X, MT8788Z, MT8792, MT8795T, MT8796, MT8798
Affected Software Versions Android 12.0, 13.0, 14.0


Vulnerability Type Definition

Abbreviation Definition
RCE Remote Code Execution
EoP Elevation of Privilege
ID Information Disclosure
DoS Denial of Service
N/A Classification not available


Versions

Version Date Description
1.0 May 6, 2024 Bulletin published.


Notes

Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.

If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.