CVE-2024-20036 - Vulnerability Details - OpenCVE

In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Mediatek	Mt6835 Mt6855 Mt6879 Mt6886 Mt6895 Mt6983 Mt6985 Mt8792 Mt8796 Mt8798

No data.

No data.

References

Link	Providers
https://corp.mediatek.com/product-security-bulletin/March-2024

History

Thu, 20 Mar 2025 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt6835 Mediatek mt6855 Mediatek mt6879 Mediatek mt6886 Mediatek mt6895 Mediatek mt6983 Mediatek mt6985 Mediatek mt8792 Mediatek mt8796 Mediatek mt8798
CPEs		cpe:2.3:h:mediatek:mt6835:-:::::::* cpe:2.3:h:mediatek:mt6855:-:::::::* cpe:2.3:h:mediatek:mt6879:-:::::::* cpe:2.3:h:mediatek:mt6886:-:::::::* cpe:2.3:h:mediatek:mt6895:-:::::::* cpe:2.3:h:mediatek:mt6983:-:::::::* cpe:2.3:h:mediatek:mt6985:-:::::::* cpe:2.3:h:mediatek:mt8792:-:::::::* cpe:2.3:h:mediatek:mt8796:-:::::::* cpe:2.3:h:mediatek:mt8798:-:::::::*
Vendors & Products		Mediatek Mediatek mt6835 Mediatek mt6855 Mediatek mt6879 Mediatek mt6886 Mediatek mt6895 Mediatek mt6983 Mediatek mt6985 Mediatek mt8792 Mediatek mt8796 Mediatek mt8798
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Mar 2025 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Mon, 26 Aug 2024 22:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2024-03-04T02:43:51.821Z

Updated: 2025-03-20T19:08:25.591Z

Reserved: 2023-11-02T13:35:35.153Z

Link: CVE-2024-20036

Vulnrichment

Updated: 2024-08-01T21:52:31.630Z

NVD

Status : Awaiting Analysis

Published: 2024-03-04T03:15:07.717

Modified: 2025-03-20T19:15:27.843

Link: CVE-2024-20036

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20036", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2023-11-02T13:35:35.153Z", "datePublished": "2024-03-04T02:43:51.821Z", "dateUpdated": "2025-03-20T19:08:25.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2024-03-04T02:43:51.821Z"}, "descriptions": [{"lang": "en", "value": "In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MT6835, MT6855, MT6879, MT6886, MT6895, MT6983, MT6985, MT8792, MT8796, MT8798", "versions": [{"version": "Android 12.0, 13.0, 14.0", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Information Disclosure"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:52:31.630Z"}, "title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "affected": [{"vendor": "mediatek", "product": "mt6835", "cpes": ["cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6855", "cpes": ["cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6879", "cpes": ["cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6886", "cpes": ["cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6895", "cpes": ["cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6983", "cpes": ["cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt6985", "cpes": ["cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt8792", "cpes": ["cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt8796", "cpes": ["cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt8798", "cpes": ["cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-26T20:55:14.066652Z", "id": "CVE-2024-20036", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-20T19:08:25.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:52:31.630Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-20036", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-26T20:55:14.066652Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6835", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6855", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6879", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6886", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6895", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6983", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6985", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt8792", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt8796", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt8798", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T20:52:47.785Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MT6835, MT6855, MT6879, MT6886, MT6895, MT6983, MT6985, MT8792, MT8796, MT8798", "versions": [{"status": "affected", "version": "Android 12.0, 13.0, 14.0"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024"}], "descriptions": [{"lang": "en", "value": "In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Information Disclosure"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2024-03-04T02:43:51.821Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20036", "state": "PUBLISHED", "dateUpdated": "2025-03-20T19:08:25.591Z", "dateReserved": "2023-11-02T13:35:35.153Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2024-03-04T02:43:51.821Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.1"}