MediaTek chip eavesdropping bugs affect 37% of smartphones and IoT devices worldwide

Multiple security weaknesses have been disclosed in MediaTek system-on-chips (SoCs) that could allow a threat actor to escalate privileges and execute arbitrary code in audio-processor firmware, potentially enabling a mass eavesdropping campaign without users' knowledge.

The flaws were discovered when Israeli cybersecurity company Check Point Research reverse-engineered the Taiwanese company's audio digital signal processor (DSP) unit. Researchers found that, when combined with other flaws in a smartphone manufacturer's libraries, the chip issues could allow local privilege escalation from an Android application.

"A malformed inter-processor message could potentially be used by an attacker to execute and hide malicious code inside DSP firmware," Check Point security researcher Slava Makkaveev said in a report. "Because DSP firmware can access the audio-data stream, an attack against the DSP could potentially be used to eavesdrop on the user."

Tracked as CVE-2021-0661, CVE-2021-0662 and CVE-2021-0663, the three issues concern a heap-based buffer overflow in the audio DSP component that could be exploited to obtain elevated privileges. Affected chipsets listed include MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893 and MT607 across Android versions.

"In the audio DSP, there is a possible out-of-bounds write due to incorrect bounds checking. This could lead to local privilege escalation requiring system execution privileges. User interaction is not needed for exploitation," the chipmaker said.

A fourth issue in MediaTek's audio hardware abstraction layer, or HAL, CVE-2021-0673, has been fixed since October and is expected to appear in the December 2021 MediaTek Security Bulletin.

In a hypothetical attack, a rogue application installed through social engineering could use its access to Android's AudioManager API to target a specialised library called Android Aurisys HAL. This library communicates with device audio drivers and could be sent crafted messages leading to attacker-code execution and theft of audio-related information.

Following disclosure, MediaTek said it had made appropriate mitigations available to all original equipment manufacturers and found no evidence that the flaws were currently being exploited. The company also recommended updating devices when patches become available and installing applications only from trusted marketplaces such as Google Play Store.

The MediaTek chip eavesdropping bugs affect 37% of smartphones and IoT devices worldwide.