CVE-2024-20128
📋 TL;DR
This CVE describes an out-of-bounds read vulnerability in MediaTek telephony components that could allow remote denial of service attacks without user interaction. The vulnerability affects devices using MediaTek chipsets with vulnerable telephony firmware. Attackers could potentially crash telephony services remotely.
💻 Affected Systems
- MediaTek chipset-based devices with telephony functionality
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers could cause persistent denial of service to telephony functions, potentially disrupting voice calls, SMS, and mobile data services on affected devices.
Likely Case
Temporary disruption of telephony services requiring device reboot to restore functionality, with potential for repeated attacks.
If Mitigated
With proper network segmentation and access controls, impact limited to denial of service within controlled network segments.
🎯 Exploit Status
No authentication or user interaction required. Exploitation likely involves sending specially crafted telephony protocol packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware with patch ID ALPS09289881
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/December-2024
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates. 2. Apply MediaTek-provided firmware patch ALPS09289881. 3. Reboot device after patch installation. 4. Verify patch installation through version checking.
🔧 Temporary Workarounds
Network segmentation
allIsolate devices from untrusted networks to prevent remote exploitation
Firewall restrictions
allBlock unnecessary telephony protocol ports from untrusted sources
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict access controls
- Implement network monitoring for telephony service disruptions and anomalous traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against MediaTek advisory; devices with pre-patch firmware are vulnerableCheck Version:
Device-specific commands vary by manufacturer; typically in Settings > About Phone > Build NumberVerify Fix Applied:
Verify firmware version includes patch ID ALPS09289881 and test telephony functionality📡 Detection & Monitoring
Log Indicators:
- Telephony service crashes
- Modem/radio subsystem restarts
- Unexpected telephony process terminations
Network Indicators:
- Anomalous telephony protocol traffic patterns
- Unexpected connection attempts to telephony ports
SIEM Query:
source="telephony" AND (event="crash" OR event="restart") OR dest_port IN (telephony_ports) AND protocol_anomaly=true