MediaTek M4U Driver Arbitrary Memory Overwrite
Description
MediaTek is a company that provides system-on-chip solutions for wireless communications, HDTV, DVD and Blu-ray. A number of MediaTek clients including Huawei, and Neffos were found to be affected by a vulnerability in the MediaTek M4U driver code.
The ‘/proc/m4u’ file provides an IOCTL interface which is vulnerable to a one-byte kernel memory overwrite while processing the 'MTK_M4U_T_CONFIG_TF' command.
Impact
Local attackers can exploit this issue to gain root privileges or achieve kernel mode code execution.
Cause
This vulnerability is due to lack of input validation of user supplied data.
Solution
MediaTek clients can receive the security fix directly from the vendor.
Technical details
Please refer to the attached advisory.