CVE-2024-20040: Linuxfoundation Yocto Privilege Escalation

CVE-2024-20040 Overview

CVE-2024-20040 is an out-of-bounds write vulnerability in MediaTek WLAN firmware caused by improper input validation. An adjacent-network attacker can exploit the flaw without authentication or user interaction to achieve remote privilege escalation on affected devices. The issue spans a broad range of MediaTek chipsets used in Android smartphones, Wi-Fi routers, IoT gateways, and embedded platforms running Yocto, OpenWrt, RDK-B, and the Linux kernel. MediaTek tracks the fix under Patch ID ALPS08360153 for MT6XXX chipsets and WCNCR00363530 for MT79XX chipsets, with internal Issue ID MSV-979. The weakness is classified under CWE-787: Out-of-bounds Write.

Critical Impact
An unauthenticated attacker within Wi-Fi range can trigger memory corruption in WLAN firmware and escalate privileges on the target device without any user interaction.

Affected Products

MediaTek chipsets including MT6580, MT6761–MT6990 series, MT7902/MT7915–MT7927, MT7981/MT7986, MT8188–MT8798 series
Google Android 12.0, 13.0, and 14.0 devices built on affected MediaTek platforms
Network and embedded distributions using MediaTek WLAN firmware: OpenWrt 19.07 and 21.02, Yocto 3.3 and 4.0, RDK-B 2022q3, and Linux kernel 4.19

Discovery Timeline

2024-04-01 - CVE-2024-20040 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20040

Vulnerability Analysis

The vulnerability resides in MediaTek's WLAN firmware, which processes 802.11 management and data frames received over the air. The firmware fails to validate attacker-controlled fields in incoming wireless frames before writing to a fixed-size buffer. When the input exceeds expected bounds, the firmware writes past the allocated region, corrupting adjacent memory structures on the WLAN subsystem.

Because the flaw lives inside firmware executing below the operating system, successful exploitation grants privileges that bypass Android sandboxing and typical OS-level mitigations. The attacker requires adjacency to the Wi-Fi network but does not need to be associated or authenticated. No user action is required, making the vulnerability suitable for opportunistic attacks against any device broadcasting or scanning nearby.

Root Cause

The root cause is improper input validation on a length or index field parsed from a WLAN frame. The firmware trusts an attacker-controlled value and uses it to compute a write offset or copy length, producing a classic out-of-bounds write [CWE-787]. Insufficient bounds checking on this control path allows the write to extend beyond the target buffer.

Attack Vector

An attacker within radio range crafts a malicious Wi-Fi frame targeting the vulnerable parsing routine in the WLAN firmware. Upon receipt, the firmware processes the frame and performs the out-of-bounds write, corrupting firmware memory. Chaining the corruption with control-flow hijacking allows escalation into WLAN firmware privileges, which in turn can be leveraged against the host OS. Refer to the MediaTek April 2024 Security Bulletin for vendor technical details. Because no verified public exploit exists, technical specifics are described in prose without proof-of-concept code.

Detection Methods for CVE-2024-20040

Indicators of Compromise

Unexpected WLAN driver or firmware crashes, kernel panics, or mtk_wifi watchdog resets logged by the device
Wi-Fi interface repeatedly disconnecting, reassociating, or resetting without user action
Anomalous management frames (association, action, or vendor-specific frames) targeting a specific client MAC from an unknown BSSID

Detection Strategies

Monitor mobile device management (MDM) and endpoint telemetry for Android devices reporting WLAN firmware exceptions or unusual reboots
On OpenWrt and RDK-B gateways, alert on repeated mt76, mt7915, or mt7921 driver errors and firmware reload events in dmesg and syslog
Deploy wireless intrusion detection (WIDS) to flag malformed or oversized 802.11 frames and vendor-specific information elements targeting MediaTek clients

Monitoring Recommendations

Centralize kernel and driver logs from Android fleets, OpenWrt routers, and RDK-B customer premises equipment to a SIEM for correlation
Track patch level advertised by MediaTek-based Android devices against the April 2024 security patch level to identify unpatched endpoints
Baseline normal Wi-Fi association behavior per site so that clusters of simultaneous WLAN resets can be triaged as potential exploitation attempts

How to Mitigate CVE-2024-20040

Immediate Actions Required

Apply the April 2024 Android security patch level or later to all MediaTek-based mobile devices
Update OpenWrt, Yocto-based, and RDK-B firmware to builds that incorporate MediaTek patches ALPS08360153 (MT6XXX) and WCNCR00363530 (MT79XX)
Inventory all MediaTek chipsets in the environment using the affected products list and prioritize internet-exposed access points and consumer premises equipment

Patch Information

MediaTek addressed the flaw in the MediaTek April 2024 Security Bulletin under Issue ID MSV-979. Device vendors integrate the fix through the MediaTek BSP; Android OEMs deliver it through the monthly security patch level, and network device vendors publish updated firmware images built against the patched WLAN driver stack.

Workarounds

Disable Wi-Fi on affected devices when operating in untrusted environments until patches are applied
Segment MediaTek-based IoT and network equipment onto isolated management VLANs to limit adjacent-network exposure
Restrict access to Wi-Fi networks using enterprise authentication and reduce broadcast coverage in high-risk areas to shrink the attacker's radio footprint

bash

# Verify Android security patch level on affected devices
adb shell getprop ro.build.version.security_patch
# Expected: 2024-04-01 or later

# On OpenWrt, confirm mt76/mt7915 driver and firmware version
opkg list-installed | grep -E 'mt76|mt7915|mt7921'
dmesg | grep -Ei 'mt7915|mt7921|firmware'