#VU98119 Out-of-bounds read in MediaTek products - CVE-2024-20097
Vulnerability identifier: #VU98119
Vulnerability risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-125
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
MT6761
Mobile applications /
Mobile firmware & hardware
MT6765
Mobile applications /
Mobile firmware & hardware
MT6768
Mobile applications /
Mobile firmware & hardware
MT6789
Mobile applications /
Mobile firmware & hardware
MT8666
Mobile applications /
Mobile firmware & hardware
MT8667
Mobile applications /
Mobile firmware & hardware
MT8673
Mobile applications /
Mobile firmware & hardware
MT8675
Mobile applications /
Mobile firmware & hardware
MT8678
Mobile applications /
Mobile firmware & hardware
MT6785
Hardware solutions /
Firmware
MT6853
Hardware solutions /
Firmware
MT6873
Hardware solutions /
Firmware
MT6885
Hardware solutions /
Firmware
Vendor: MediaTek
Description
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a missing bounds check within vdec. A local privileged application can gain access to sensitive information.
Mitigation
Install security update from vendor's website.
Vulnerable software versions
MT6761: All versions
MT6765: All versions
MT6768: All versions
MT6785: All versions
MT6789: All versions
MT6853: All versions
MT6873: All versions
MT6885: All versions
MT8666: All versions
MT8667: All versions
MT8673: All versions
MT8675: All versions
MT8678: All versions
External links
https://corp.mediatek.com/product-security-bulletin/October-2024
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
