CVE-2023-20698

Vulnerability

In the keyinstall component on MediaTek chipsets, an out-of-bounds read vulnerability exists due to a missing bounds check. This flaw affects devices built with chipsets such as MT2731, MT2735, MT2737, MT6580, MT6739, MT6761, MT6762, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6880, and others listed in [1]. The affected patch ID is ALPS07589144 and issue ID is ALPS07589144 [1]. No user interaction is required for exploitation.

Exploitation

An attacker must already have System execution privileges on the device. With that level of access, the attacker can trigger the missing bounds check, leading to an out-of-bounds read. No further user interaction is needed [1].

Impact

Successful exploitation leads to local information disclosure of sensitive data that resides within the memory space accessible via the out-of-bounds read. The attacker gains additional knowledge that they would not normally have, but does not escalate privileges beyond the already held System level [1].

Mitigation

MediaTek has released a security patch (ALPS07589144) to device OEMs at least two months prior to the publication date of May 5, 2023 [1]. Device vendors should incorporate this patch into their firmware updates. Users should apply any available updates from their device manufacturer. No workaround is mentioned [1].