MediaTek Chipsets GNSS Driver Integer Overflow Vulnerability Allowing Local Information Disclosure

A vulnerability has been identified in the GNSS driver of certain MediaTek chipsets, where an integer overflow can lead to an out-of-bounds read. This issue could result in local information disclosure, but requires that the malicious actor has already obtained system privileges. The vulnerability arises from an incorrect bounds check, allowing for potential exploitation without user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, potentially allowing for further exploitation of the affected system or application.

Remediation

Device OEMs have been notified of this vulnerability and the corresponding security patches are available. For further information, OEMs can contact their MediaTek representative.