important · Firmware — MediaTek
Two MediaTek decoder heap writes are described as local elevation paths across 54 chipsets.
Affects
MediaTek video-decoder components in Android and embedded devices using the listed MediaTek chipsets.
An unprivileged local process must reach an unpublished video-ingestion route before either missing bounds check produces its heap out-of-bounds write.
Detail and 1 source
We do not know whether the writes are controllable into code execution or which final privilege context they cross.
Chain to watch
Obtain unprivileged local execution on an affected device→↓Reach the MediaTek video-decoder input path→↓Trigger a heap out-of-bounds write and attempt privilege escalation→↓Controllability and the final Android or firmware privilege context are unknown.
Unverified chainReproduce each malformed input on an OEM build while recording the decoder process, SELinux domain and resulting memory control.
MediaTek announced a patch and identified the chipset scope.
Sources