CVE-2024-20143: Medium severity linuxfoundation Yocto vulnerability

Published Jan 6, 2025

Updated

In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2069.

Affected Software

31 affected components

All of the following

Any of the following

linuxfoundation Yocto=4.0

Rdkcentral Rdk-b=2022q3

Rdkcentral Rdk-b=2024q1

Google Android=12.0

Google Android=13.0

Google Android=14.0

Google Android=15.0

OpenWrt OpenWrt=19.07.0

OpenWrt OpenWrt=21.02.0

OpenWrt OpenWrt=23.05

Any of the following

MediaTek Mt2737

MediaTek Mt6781

MediaTek Mt6789

MediaTek Mt6835

MediaTek Mt6855

MediaTek Mt6878

MediaTek Mt6879

MediaTek Mt6880

MediaTek Mt6886

MediaTek Mt6890

MediaTek Mt6895

MediaTek Mt6897

MediaTek Mt6980

MediaTek Mt6983

MediaTek Mt6985

MediaTek Mt6989

MediaTek Mt6990

MediaTek Mt8370

MediaTek Mt8390

MediaTek Mt8676

Google Android

Event History

Jan 6, 2025

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

CVE Published

via MITRE·03:17 AM

Data Sourced

via MITRE·03:17 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2024-20143?

CVE-2024-20143 is considered a high severity vulnerability due to its potential for local privilege escalation.

How do I fix CVE-2024-20143?

To fix CVE-2024-20143, apply the security patch identified as ALPS09167056 from the vendor.

What software is affected by CVE-2024-20143?

CVE-2024-20143 affects devices running Google Android that have the vulnerability present.

Is user interaction required to exploit CVE-2024-20143?

Yes, user interaction is needed for the exploitation of CVE-2024-20143.

Can CVE-2024-20143 lead to remote exploitation?

No, CVE-2024-20143 requires physical access to the device for exploitation.