CVE-2024-20147
📋 TL;DR
This CVE describes a Bluetooth firmware vulnerability in MediaTek chipsets where improper exception handling could trigger a reachable assertion. This allows remote attackers to cause denial of service without user interaction or additional privileges. Affected devices include those using MT79XX, MT2737, MT3603, MT6XXX, and MT8XXX chipsets with vulnerable Bluetooth firmware.
💻 Affected Systems
- MediaTek MT79XX chipsets
- MediaTek MT2737 chipsets
- MediaTek MT3603 chipsets
- MediaTek MT6XXX chipsets
- MediaTek MT8XXX chipsets
📦 What is this software?
Android by Google
Android by Google
Android by Google
Openwrt by Openwrt
Yocto by Linuxfoundation
Yocto by Linuxfoundation
Yocto by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker could crash Bluetooth functionality on affected devices, disrupting wireless connectivity and potentially affecting device usability until reboot.
Likely Case
Bluetooth service disruption on vulnerable devices, requiring device restart to restore functionality.
If Mitigated
Minimal impact if patched firmware is installed or Bluetooth is disabled on vulnerable devices.
🎯 Exploit Status
Exploitation requires Bluetooth proximity and knowledge of vulnerable chipsets. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WCNCR00389046 for MT79XX chipsets / ALPS09136501 for MT2737, MT3603, MT6XXX, and MT8XXX chipsets
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/February-2025
Restart Required: Yes
Instructions:
1. Check device chipset model. 2. Contact device manufacturer for firmware update. 3. Apply appropriate patch: WCNCR00389046 for MT79XX or ALPS09136501 for others. 4. Reboot device after update.
🔧 Temporary Workarounds
Disable Bluetooth
allTurn off Bluetooth functionality to prevent exploitation
# Linux: rfkill block bluetooth
# Windows: Disable in Device Manager or Settings
# Android/iOS: Turn off Bluetooth in settings
Limit Bluetooth Visibility
allSet Bluetooth to non-discoverable mode to reduce attack surface
# Varies by device - typically in Bluetooth settings
🧯 If You Can't Patch
- Segment network to isolate Bluetooth devices from untrusted networks
- Implement physical security controls to limit proximity-based attacks
🔍 How to Verify
Check if Vulnerable:
Check device specifications for MediaTek chipset models MT79XX, MT2737, MT3603, MT6XXX, or MT8XXX and verify Bluetooth firmware version with manufacturerCheck Version:
# Varies by device - typically in About or System Information sectionsVerify Fix Applied:
Confirm firmware update to WCNCR00389046 or ALPS09136501 has been applied through device settings or manufacturer tools📡 Detection & Monitoring
Log Indicators:
- Bluetooth service crashes
- Unexpected Bluetooth disconnections
- Firmware assertion failures in system logs
Network Indicators:
- Multiple Bluetooth connection attempts from unknown devices
- Unusual Bluetooth traffic patterns
SIEM Query:
Device logs showing Bluetooth service restarts or firmware errors from MediaTek chipsets