December 2023 Product Security Bulletin

Published 2023-12-04
The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT, Wi-Fi, TV, Computer Vision and Audio chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.

The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).


Summary

Severity CVEs
High CVE-2023-32847, CVE-2023-32848, CVE-2023-32850, CVE-2023-32851, CVE-2023-32841, CVE-2023-32842, CVE-2023-32843
Medium CVE-2023-32849, CVE-2023-32852, CVE-2023-32853, CVE-2023-32854, CVE-2023-32855, CVE-2023-32856, CVE-2023-32857, CVE-2023-32858, CVE-2023-32844, CVE-2023-32845, CVE-2023-32846, CVE-2023-32859, CVE-2023-32860, CVE-2023-32861, CVE-2023-32862, CVE-2023-32863, CVE-2023-32864, CVE-2023-32865, CVE-2023-32866, CVE-2023-32867, CVE-2023-32868, CVE-2023-32869, CVE-2023-32870


Details

CVE CVE-2023-32847
Title Out-of-bounds write in audio
Severity High
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Chipsets MT2713, MT6580, MT6739, MT6761, MT6762, MT6765, MT6779, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6895, MT6983, MT6985, MT8167, MT8167S, MT8168, MT8175, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32848
Title Incorrect comparison in vdec
Severity High
Vulnerability Type EoP
CWE CWE-697 Incorrect Comparison
Description In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885
Affected Software Versions Android 11.0, 12.0, 13.0

CVE CVE-2023-32850
Title Integer underflow (wrap or wraparound) in decoder
Severity High
Vulnerability Type EoP
CWE CWE-191 Integer Underflow (Wrap or Wraparound)
Description In decoder, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Chipsets MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6893, MT6895, MT6983, MT8167, MT8167S, MT8168, MT8175, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
Affected Software Versions Android 11.0, 12.0

CVE CVE-2023-32851
Title Incorrect calculation of buffer size in decoder
Severity High
Vulnerability Type EoP
CWE CWE-131 Incorrect Calculation of Buffer Size
Description In decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Chipsets MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT6855, MT6877, MT6879, MT6883, MT6885, MT6893, MT6895, MT6983, MT8167, MT8167S, MT8168, MT8175, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
Affected Software Versions Android 11.0, 12.0

CVE CVE-2023-32841
Title Reachable assertion in 5G Modem
Severity High
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32842
Title Reachable assertion in 5G Modem
Severity High
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32843
Title Reachable assertion in 5G Modem
Severity High
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32849
Title Incorrect comparison in cmdq
Severity Medium
Vulnerability Type EoP
CWE CWE-697 Incorrect Comparison
Description In cmdq, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6781, MT6785, MT6833, MT6853, MT6873, MT6885, MT6889, MT6893, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8791, MT8791T, MT8797, MT8798
Affected Software Versions Android 11.0, 12.0, 13.0

CVE CVE-2023-32852
Title Improper input validation in cameraisp
Severity Medium
Vulnerability Type ID
CWE CWE-20 Improper Input Validation
Description In cameraisp, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6779
Affected Software Versions Android 11.0, 12.0, 13.0

CVE CVE-2023-32853
Title Out-of-bounds write in rpmb
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In rpmb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8321, MT8365
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32854
Title Out-of-bounds write in ril
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6835, MT6879, MT6886, MT6895, MT6983, MT6985, MT8321, MT8667, MT8673, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32855
Title Improper access control in aee
Severity Medium
Vulnerability Type EoP
CWE CWE-120 Improper Access Control
Description In aee, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6765, MT6768, MT6769, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6885, MT6889, MT6890, MT6893, MT6895, MT6980, MT6983, MT6985, MT6990, MT8667, MT8765, MT8768, MT8786, MT8791, MT8791T, MT8791WIFI, MT8798
Affected Software Versions Android 12.0, 13.0 / OpenWrt 1907, 2102 / Yocto 2.6, 3.3, 4.0 / RDK-B 22Q3

CVE CVE-2023-32856
Title Buffer copy without checking size of input ('classic buffer overflow') in display
Severity Medium
Vulnerability Type ID
CWE CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Description In display, there is a possible out of bounds read due to an incorrect status check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6765, MT6768, MT6833, MT6879, MT6883, MT6885, MT6889, MT6893, MT6983, MT6985, MT8188, MT8195, MT8797, MT8798
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32857
Title Buffer copy without checking size of input ('classic buffer overflow') in display
Severity Medium
Vulnerability Type ID
CWE CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Description In display, there is a possible out of bounds read due to an incorrect status check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6765, MT6768, MT6833, MT6879, MT6883, MT6885, MT6889, MT6893, MT6983, MT6985, MT8188, MT8195, MT8797, MT8798
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32858
Title Information disclosure in GZ
Severity Medium
Vulnerability Type ID
CWE CWE-200 Information Disclosure
Description In GZ, there is a possible information disclosure due to a missing data erasing. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6771, MT6835, MT6886, MT6983, MT6985, MT8766, MT8768, MT8788
Affected Software Versions Android 13.0

CVE CVE-2023-32844
Title Reachable assertion in 5G Modem
Severity Medium
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32845
Title Reachable assertion in 5G Modem
Severity Medium
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32846
Title Reachable assertion in 5G Modem
Severity Medium
Vulnerability Type DoS
CWE CWE-617 Reachable Assertion
Description In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT2735, MT2737, MT6297, MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990
Affected Software Versions Modem NR15, NR16, and NR17

CVE CVE-2023-32859
Title Classic buffer overflow in meta
Severity Medium
Vulnerability Type EoP
CWE CWE-120 Classic Buffer Overflow
Description In meta, there is a possible classic buffer overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8188T, MT8195, MT8321, MT8362A, MT8365, MT8390, MT8395, MT8666, MT8675, MT8766, MT8768, MT8786, MT8788, MT8789, MT8797
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32860
Title Classic buffer overflow in display
Severity Medium
Vulnerability Type EoP
CWE CWE-120 Classic Buffer Overflow
Description In display, there is a possible classic buffer overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32861
Title Out-of-bounds read in display
Severity Medium
Vulnerability Type EoP
CWE CWE-125 Out-of-bounds Read
Description In display, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8167, MT8168, MT8188, MT8195, MT8673
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32862
Title Out-of-bounds read in display
Severity Medium
Vulnerability Type EoP
CWE CWE-125 Out-of-bounds Read
Description In display, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8188, MT8195, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32863
Title Out-of-bounds read in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-125 Out-of-bounds Read
Description In display drm, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32864
Title Out-of-bounds write in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In display drm, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8195, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32865
Title Out-of-bounds write in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In display drm, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32866
Title Out-of-bounds write in mmp
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In mmp, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8188, MT8195, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32867
Title Out-of-bounds write in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8188, MT8195, MT8673, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32868
Title Out-of-bounds write in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8188, MT8195, MT8673, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32869
Title Out-of-bounds write in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-787 Out-of-bounds Write
Description In display drm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8188, MT8195, MT8673, MT8781
Affected Software Versions Android 12.0, 13.0

CVE CVE-2023-32870
Title Out-of-bounds read in display drm
Severity Medium
Vulnerability Type EoP
CWE CWE-125 Out-of-bounds Read
Description In display drm, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8168, MT8183, MT8188, MT8195, MT8673, MT8781
Affected Software Versions Android 12.0, 13.0


Vulnerability Type Definition

Abbreviation Definition
RCE Remote Code Execution
EoP Elevation of Privilege
ID Information Disclosure
DoS Denial of Service
N/A Classification not available


Versions

Version Date Description
1.0 December 4, 2023 Bulletin published.
1.1 December 28, 2023 Updated CVE table.


Notes

Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.

If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.