CVE-2023-20709

Vulnerability

In keyinstall on multiple MediaTek chipsets (MT2731, MT2735, MT2737, MT6580, MT6739, MT6761, MT6762, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6880, and others), a missing bounds check allows an out-of-bounds read. Only devices with System execution privileges can trigger this code path. The vulnerability is identified by patch ID ALPS07576951. Affected versions are those before the May 2023 security patch level [1].

Exploitation

The attacker requires System execution privileges on the targeted device, meaning they already have elevated kernel-level access. No user interaction is needed for exploitation. The precise steps are not detailed in the available references, but the out-of-bounds read occurs due to the absence of a bounds check in the keyinstall code path [1].

Impact

Successful exploitation leads to local information disclosure, as sensitive memory contents may be leaked. The impact is limited to confidentiality; integrity and availability are not compromised. The disclosure could reveal key material or other privileged data accessible only to the System-level process [1].

Mitigation

The patch is available via MediaTek's May 2023 Product Security Bulletin. Device OEMs have been notified and the fix is part of the standard security update for that month. Users should apply the OTA update from their device manufacturer. No workaround is provided. The vulnerability is not listed on the CISA KEV at the time of writing [1].