CVE-2023-20643

Vulnerability

In the MediaTek radio interface layer (ril), a missing bounds check on an input buffer leads to an out-of-bounds write. This vulnerability affects multiple MediaTek chipsets as listed in the March 2023 Product Security Bulletin [1]. The exact affected software versions are not publicly detailed, but the bulletin indicates that patches have been provided to device OEMs.

Exploitation

An attacker must already possess System execution privileges on the device. No user interaction is required. The attacker can trigger the out-of-bounds write by sending a crafted input to the ril component, exploiting the missing bounds check to write beyond the allocated buffer.

Impact

Successful exploitation results in local escalation of privilege. The out-of-bounds write can corrupt kernel memory or other critical structures, potentially allowing the attacker to gain higher privileges or execute arbitrary code in a privileged context.

Mitigation

MediaTek released a patch (ALPS07628584) to address this issue. Device OEMs have been notified and are expected to deploy the fix via security updates. Users should apply the latest firmware updates from their device manufacturer. As of March 2023, the patch is available [1].