Possible Out of Bounds Write Leads to Local Escalation of Privilege
CVE-2024-20057

7.2HIGH

Key Information:

Vendor
MediaTek
Status
Mt6761, Mt6765, Mt6768, Mt6779, Mt6781, Mt6785, Mt6789, Mt6833, Mt6835, Mt6853, Mt6855, Mt6873, Mt6877, Mt6879, Mt6883, Mt6885, Mt6886, Mt6889, Mt6893, Mt6895, Mt6897, Mt6983, Mt8321, Mt8385, Mt8755, Mt8765, Mt8766, Mt8768, Mt8771, Mt8781, Mt8786, Mt8788, Mt8789, Mt8791t, Mt8792, Mt8795t, Mt8796
Vendor
CVE Published:
6 May 2024

Summary

The keyInstall component in MediaTek products has a potential vulnerability due to a missing bounds check, which may allow for an out of bounds write. This flaw can lead to local privilege escalation, requiring system execution privileges to exploit. Importantly, user interaction is not necessary for the exploitation of this vulnerability. Affected users should consider patching as soon as possible to mitigate risks associated with unauthorized access to system-level functions.

Affected Version(s)

MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6983, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796 Android 12.0, 13.0, 14.0

References

https://corp.mediatek.com/product-security-bulletin/May-2024

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.