CVE-2021-0675 Overview
CVE-2021-0675 is an out-of-bounds write vulnerability [CWE-787] in the Apple Lossless Audio Codec (ALAC) decoder shipped with MediaTek chipsets used in Google Android devices. The flaw stems from an incorrect bounds check that allows a local attacker to write outside the intended memory region during audio decoding. Successful exploitation leads to local privilege escalation without requiring user interaction or additional execution privileges. MediaTek tracks the issue under Patch ID ALPS06064258 and addressed it in the December 2021 Security Bulletin.
Critical Impact
A local attacker on an affected Android device can trigger an out-of-bounds write in the ALAC decoder to escalate privileges with full impact on confidentiality, integrity, and availability.
Affected Products
- Google Android versions 8.1, 9.0, 10.0, and 11.0 running on affected MediaTek chipsets
- MediaTek MT6xxx series chipsets (MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6753, MT6755, MT6757, MT6761, MT6765, MT6768, MT6771, MT6779, MT6785, MT6833, MT6853, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, and related variants)
- MediaTek MT8xxx series chipsets (MT8163, MT8167, MT8168, MT8173, MT8175, MT8176, MT8183, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797)
Discovery Timeline
- 2021-12-15 - CVE-2021-0675 published to NVD
- December 2021 - MediaTek releases security patch ALPS06064258 via the MediaTek Security Bulletin December 2021
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-0675
Vulnerability Analysis
The vulnerability resides in the ALAC (Apple Lossless Audio Codec) decoder used in MediaTek media subsystems on Android. An incorrect bounds check during decoding allows a crafted input to drive a write beyond the bounds of the destination buffer. Because the decoder runs in a privileged media context on the device, corrupting adjacent memory can be leveraged to alter program state and redirect execution flow. The result is local escalation of privilege from a lower-privileged process to a higher-privileged context handling media operations.
Root Cause
The root cause is an out-of-bounds write [CWE-787] caused by an incorrect bounds check inside the ALAC decoder. The decoder does not properly validate input-derived sizes against the destination buffer length before writing decoded audio samples. Maliciously structured ALAC stream metadata can therefore cause the decoder to write past allocated memory, corrupting heap or stack structures used by the media component.
Attack Vector
The attack vector is local. An attacker requires the ability to execute a low-privileged application or supply crafted ALAC content to the affected decoder on the device. User interaction is not required. Once the malicious audio data is processed, the out-of-bounds write triggers memory corruption that can be shaped into arbitrary write primitives, enabling privilege escalation within the Android media stack.
No public proof-of-concept or in-the-wild exploitation has been reported for this issue. Refer to the MediaTek Security Bulletin December 2021 for vendor technical details.
Detection Methods for CVE-2021-0675
Indicators of Compromise
- Unexpected crashes or tombstone entries in /data/tombstones/ referencing the media codec process or ALAC decoding routines
- Repeated SIGSEGV or SIGABRT signals from the media server process when handling audio files
- Locally installed applications attempting to load or play malformed ALAC-encoded media files from untrusted sources
Detection Strategies
- Inventory Android devices and identify those running Android 8.1 through 11.0 on MediaTek chipsets listed in the December 2021 bulletin
- Verify the device security patch level via ro.build.version.security_patch and confirm it includes the December 2021 MediaTek fixes covering ALPS06064258
- Monitor mobile threat defense telemetry for applications dropping or processing untrusted ALAC content outside of standard media pipelines
Monitoring Recommendations
- Collect Android crash logs and logcat output centrally to surface anomalous media decoder failures across the fleet
- Track installation of sideloaded applications on managed devices, particularly those requesting media playback permissions
- Alert on devices that remain below the December 2021 Android security patch level after the enforcement window
How to Mitigate CVE-2021-0675
Immediate Actions Required
- Apply the December 2021 (or later) Android security patch level on all affected MediaTek-based devices
- Identify end-of-life devices that will not receive the MediaTek ALPS06064258 patch and plan replacement or restricted use
- Restrict installation of applications from untrusted sources on managed Android fleets through MDM policy
Patch Information
MediaTek released the fix under Patch ID ALPS06064258 and Issue ID ALPS06064258, distributed through the MediaTek Security Bulletin December 2021. Device OEMs incorporate this fix into their Android security patch level updates. Confirm rollout by checking that the device security patch level reflects December 2021 or later.
Workarounds
- Avoid opening ALAC-encoded audio files received from untrusted sources until the device patch level is updated
- Use MDM controls to block sideloading and restrict app installation to vetted enterprise or Play Store sources
- Decommission unsupported MediaTek-based devices that cannot receive vendor updates from sensitive workflows
# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output: 2021-12-01 or later for CVE-2021-0675 remediation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
