CVE-2024-20104 Overview
CVE-2024-20104 is an out-of-bounds write vulnerability in the MediaTek Download Agent (da) component. The flaw stems from a missing bounds check that allows a local attacker to corrupt memory outside the intended buffer. Successful exploitation leads to local escalation of privilege with no additional execution privileges required, though user interaction is needed.
The issue affects a broad range of MediaTek chipsets shipped in Android devices, OpenWrt routers, RDK-B broadband platforms, and Yocto-based firmware. MediaTek addressed the flaw under Patch ID ALPS09073261 and Issue ID MSV-1772.
Critical Impact
A local attacker can trigger an out-of-bounds write in the MediaTek Download Agent to gain elevated privileges on affected devices, impacting confidentiality, integrity, and availability.
Affected Products
- MediaTek chipsets: MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6880, MT6886, MT6890, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8188, MT8370, MT8390, MT8676
- Google Android 12.0, 13.0, 14.0, and 15.0
- OpenWrt 19.07.0, 21.02.0, 23.05; Linux Foundation Yocto 4.0; RDK-B 2022q3 and 2024q1
Discovery Timeline
- 2024-11-04 - CVE-2024-20104 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-20104
Vulnerability Analysis
The vulnerability lives inside the MediaTek Download Agent (da), a component involved in firmware download and flashing operations on MediaTek platforms. It is classified as an Out-of-Bounds Write ([CWE-787]) caused by a missing bounds check on input processed by the component.
When the da component processes attacker-influenced data, it writes past the boundaries of an allocated buffer. This corrupts adjacent memory structures and can be leveraged to redirect execution or modify privileged state. Because the component runs with elevated privileges on the device, memory corruption converts directly into a privilege escalation primitive.
The attack requires local access and user interaction, which limits mass exploitation but remains relevant for physically obtained devices, malicious apps prompting user actions, or supply-chain scenarios involving flashing tools.
Root Cause
The root cause is the absence of a length or index validation prior to a write operation in the da code path. Without the bounds check, oversized or crafted input overflows the destination buffer.
Attack Vector
An attacker with local access delivers a malformed payload to the da component. After the required user interaction, the missing bounds check permits the out-of-bounds write, corrupting memory in a privileged context and yielding code execution or privilege elevation on the target device.
No public proof-of-concept exploit code has been published. Refer to the MediaTek Security Bulletin November 2024 for vendor-supplied technical details.
Detection Methods for CVE-2024-20104
Indicators of Compromise
- Unexpected invocations of the MediaTek Download Agent (da) outside of authorized flashing or firmware update windows.
- Device or process crashes referencing memory corruption in da or associated MediaTek preloader components.
- Presence of unauthorized flashing tools or drivers on developer or engineering workstations connected to MediaTek devices.
Detection Strategies
- Inventory MediaTek-based devices against the affected chipset list and confirm whether the November 2024 MediaTek patch level is applied.
- Monitor Android security patch level (SPL) telemetry for devices missing the 2024-11 patch that addresses MSV-1772.
- On OpenWrt, RDK-B, and Yocto builds, verify vendor BSP versions include the fix for Patch ID ALPS09073261.
Monitoring Recommendations
- Track USB and debug-interface activity on managed mobile devices to catch unauthorized flashing sessions.
- Alert on installation of side-loaded applications requesting low-level device access on affected Android versions (12.0 through 15.0).
- Correlate device management logs with MediaTek advisory releases to prioritize patch deployment.
How to Mitigate CVE-2024-20104
Immediate Actions Required
- Apply the MediaTek patch corresponding to Patch ID ALPS09073261 and Issue ID MSV-1772 on all affected chipsets.
- Update Android devices to a security patch level that incorporates the November 2024 MediaTek fixes.
- For OpenWrt, RDK-B, and Yocto deployments, rebuild firmware with vendor BSPs that include the MediaTek fix.
Patch Information
MediaTek published the fix in its November 2024 Product Security Bulletin under Patch ID ALPS09073261. OEMs must integrate the patch into their device-specific firmware and distribute it through their standard update channels. Google Android devices receive the fix through the Android monthly security update aligned to the November 2024 bulletin.
Workarounds
- Restrict physical access to devices to reduce the local attack surface required by this vulnerability.
- Disable or block unauthorized USB debugging and flashing interfaces on managed endpoints where feasible.
- Enforce application allowlisting on Android devices to reduce the chance that a user is tricked into interacting with a malicious payload.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
