PT-2021-6933 · Mediatek · Mediatek Mt6885+48

Published 2021-12-01 · Updated 2023-08-08 · CVE-2021-0674

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions alac decoder versions (affected versions not specified) MediaTek MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6753, MT6755, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6758, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6797, MT6799, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8176, MT8183, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797

Description The issue is related to an incorrect bounds check in the alac decoder, which could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. The vulnerability is associated with insufficient input validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Out of bounds Read

Weakness Enumeration

CWE-20

CWE-125

Related Identifiers

BDU:2022-02693

CVE-2021-0674

Affected Products

Mediatek Mt6570

Mediatek Mt6580

Mediatek Mt6735

Mediatek Mt6737

Mediatek Mt6739

Mediatek Mt6750

Mediatek Mt6753

Mediatek Mt6755

Mediatek Mt6757

Mediatek Mt6758

Mediatek Mt6761

Mediatek Mt6763

Mediatek Mt6765

Mediatek Mt6768

Mediatek Mt6771

Mediatek Mt6779

Mediatek Mt6781

Mediatek Mt6785

Mediatek Mt6797

Mediatek Mt6799

Mediatek Mt6833

Mediatek Mt6853

Mediatek Mt6873

Mediatek Mt6877

Mediatek Mt6883

Mediatek Mt6885

Mediatek Mt6889

Mediatek Mt6893

Mediatek Mt8163

Mediatek Mt8167

Mediatek Mt8168

Mediatek Mt8173

Mediatek Mt8175

Mediatek Mt8176

Mediatek Mt8183

Mediatek Mt8185

Mediatek Mt8195

Mediatek Mt8321

Mediatek Mt8362A

Mediatek Mt8365

Mediatek Mt8385

Mediatek Mt8765

Mediatek Mt8766

Mediatek Mt8768

Mediatek Mt8786

Mediatek Mt8788

Mediatek Mt8789

Mediatek Mt8791

Mediatek Mt8797

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2021-0674 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0674 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02693 · Security Note
• https://corp.mediatek.com/product-security-bulletin/December-2021 · Vendor Advisory
• https://vuldb.com/?id.188699 · Note
• https://cve.omprussia.ru/bb16402 · Note
• https://cve.omprussia.ru/bb15323 · Note
• https://t.me/cvenotify/24775 · Telegram Post
• https://t.me/true_secator/2876 · Telegram Post
• https://t.me/cibsecurity/34214 · Telegram Post
• https://t.me/tmfeed/139370 · Telegram Post
• https://corp.mediatek.com/product-security-bulletin/December-2021#CVE_2021_0674 · Note
• https://t.me/opennews/10027 · Telegram Post
• https://t.me/ckure/11234 · Telegram Post
• https://t.me/nekaspersky/2165 · Telegram Post