CVE-2024-20146: Linuxfoundation Yocto RCE Vulnerability

CVE-2024-20146 Overview

CVE-2024-20146 is an out-of-bounds write vulnerability in the MediaTek WLAN station (STA) driver. Improper input validation allows an attacker within wireless range to write beyond allocated buffer boundaries. The flaw enables remote code execution over an adjacent network without user interaction and without additional execution privileges. MediaTek addressed the issue in its January 2025 Product Security Bulletin under Patch ID WCNCR00389496 / ALPS09137491 and Issue ID MSV-1835. The vulnerability affects a broad set of MediaTek chipsets used in Android smartphones, tablets, IoT devices, and Wi-Fi platforms, as well as downstream distributions including Google Android, OpenWrt, and Yocto-based images.

Critical Impact
Adjacent-network attackers can trigger memory corruption in the WLAN STA driver, potentially achieving remote code execution on affected MediaTek-based devices without any user interaction.

Affected Products

MediaTek Software Development Kit and chipsets including MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT6990, MT7902, MT7920, MT7922, and multiple MT8xxx series
Google Android 13.0, 14.0, and 15.0
OpenWrt 23.05 and Linux Foundation Yocto 3.3, 4.0, and 5.0

Discovery Timeline

2025-01-06 - CVE-2024-20146 published to NVD
January 2025 - MediaTek publishes security bulletin with Patch ID WCNCR00389496
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20146

Vulnerability Analysis

The vulnerability resides in the WLAN STA (station-mode) driver shipped with the MediaTek Wi-Fi software stack. The driver fails to properly validate input received over the wireless medium before writing it to an internal buffer. This causes an out-of-bounds write condition classified under [CWE-787]. Successful exploitation corrupts kernel memory adjacent to the target buffer, which can be leveraged to overwrite control data and hijack execution flow. Because the WLAN driver operates in a privileged kernel context on Android and Linux-based platforms, code execution occurs at a high privilege level.

Root Cause

The root cause is improper input validation on data processed by the STA driver when handling wireless frames or management messages. Length or field checks are missing or incomplete before the driver copies attacker-controlled data into a fixed-size buffer. This allows the write operation to exceed the buffer boundary.

Attack Vector

An attacker must be within wireless range of the target device, meaning the exploit requires adjacent-network access rather than internet-facing reachability. The attacker crafts malformed Wi-Fi frames that trigger the vulnerable code path in the STA driver during association, scanning, or normal frame processing. No authentication, user interaction, or additional privileges are required. The issue impacts integrity and availability but does not directly expose confidential data.

No verified public proof-of-concept code is available. See the MediaTek Security Bulletin January 2025 for vendor technical details.

Detection Methods for CVE-2024-20146

Indicators of Compromise

Unexpected kernel panics, WLAN driver crashes, or repeated reboots on MediaTek-based devices, particularly during Wi-Fi association or scanning
Anomalous or malformed 802.11 management frames captured on the wireless segment near affected devices
Presence of unpatched firmware builds predating the January 2025 MediaTek security bulletin

Detection Strategies

Inventory MediaTek chipsets and firmware versions across mobile, IoT, and networking assets and compare against the affected chipset list
Monitor Android and OpenWrt kernel logs (dmesg, logcat) for WLAN driver faults, stack traces referencing the STA driver, or WARN/BUG entries
Deploy wireless intrusion detection sensors to identify malformed 802.11 frames or non-standard information elements targeting nearby stations

Monitoring Recommendations

Aggregate device telemetry and mobile threat defense logs into a centralized SIEM for correlation of WLAN crash events across the fleet
Track vendor patch adoption metrics for the January 2025 MediaTek bulletin across Android OEM firmware releases
Alert on repeated WLAN driver restarts or disassociation storms that could indicate exploitation attempts

How to Mitigate CVE-2024-20146

Immediate Actions Required

Apply the MediaTek patch identified as WCNCR00389496 / ALPS09137491 through the appropriate OEM firmware update channel
Update Android devices to a security patch level that incorporates the January 2025 MediaTek bulletin fixes
Update OpenWrt 23.05 and Yocto-based images to builds that include the patched MediaTek WLAN driver

Patch Information

MediaTek released the fix in its January 2025 Product Security Bulletin under Issue ID MSV-1835. Downstream vendors, including Google Android and OpenWrt maintainers, must integrate the patched driver into their firmware releases. Consult the MediaTek Security Bulletin January 2025 for the authoritative list of affected chipsets and patch identifiers.

Workarounds

Disable Wi-Fi on affected devices in high-risk environments until firmware updates are available
Restrict devices to trusted wireless networks and avoid connecting to unknown or public Wi-Fi where an attacker could be within adjacent range
Segment IoT and embedded devices that cannot be patched onto isolated wireless networks with monitored access

bash

# Verify Android security patch level on a device
adb shell getprop ro.build.version.security_patch

# Check OpenWrt package version for MediaTek WLAN driver
opkg list-installed | grep -i mt76