CVE-2025-20635: Linuxfoundation Yocto Privilege Escalation

CVE-2025-20635 is a privilege escalation vulnerability in Linuxfoundation Yocto caused by an out of bounds write in V6 DA. Attackers with physical access can exploit this flaw to gain elevated privileges. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-20635 Overview

CVE-2025-20635 is an out-of-bounds write vulnerability in the MediaTek V6 Download Agent (DA) component. The flaw stems from a missing bounds check and affects a wide range of MediaTek chipsets used in Android devices, OpenWrt routers, Yocto-based firmware, and RDK-B broadband platforms. An attacker with physical access to a device can trigger the condition to achieve local escalation of privilege. Exploitation requires user interaction but no additional execution privileges. MediaTek assigned Patch ID ALPS09403752 and Issue ID MSV-2434, and published the fix in its February 2025 Product Security Bulletin.

Critical Impact
A successful exploit grants an attacker elevated privileges on affected devices, compromising confidentiality, integrity, and availability of the system.

Affected Products

MediaTek chipsets: MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6880, MT6886, MT6890, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8370, MT8390
Google Android 12.0, 13.0, 14.0, and 15.0
OpenWrt 19.07.0, 21.02.0, 22.03.5; RDK-B 2022q3 and 2024q1; Yocto 4.0

Discovery Timeline

2025-02-03 - CVE-2025-20635 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20635

Vulnerability Analysis

The vulnerability resides in the V6 Download Agent (DA), a low-level MediaTek component that runs during boot-time and recovery flows to handle flashing and firmware transfer operations. The DA receives structured data from a host over a physical interface and writes it into memory buffers managed by the agent. A missing bounds check on an incoming length or offset field permits writes beyond the end of an allocated buffer. This behavior is classified under [CWE-787: Out-of-bounds Write].

Because the DA executes with elevated privileges below the standard operating system, corrupting adjacent memory can alter execution flow or control structures used by the agent. The attacker's goal is to pivot from a controlled memory write into execution within the DA context, which sits beneath Android or Linux-based firmware running on the device.

Root Cause

The root cause is the absence of input validation on size or index parameters before copying attacker-supplied data into a destination buffer in the V6 DA. Without clamping the write length against the buffer capacity, crafted inputs push data past the allocated region and overwrite adjacent memory.

Attack Vector

Exploitation requires physical access to the target device and user interaction. The attacker connects to the device's debug or flashing interface, places the device into a mode that loads the V6 DA, and transmits a malformed payload that triggers the out-of-bounds write. Successful exploitation elevates privileges locally on the device. Remote exploitation over a network is not possible.

The vulnerability is described in prose only; no public proof-of-concept code has been released. See the MediaTek Security Bulletin February 2025 for vendor technical details.

Detection Methods for CVE-2025-20635

Indicators of Compromise

Unexpected device entries into bootloader, download, or BROM mode outside of authorized servicing windows.
Firmware image hashes or DA binaries that do not match vendor-signed references after a servicing event.
Physical evidence of debug cable connections or disassembled device chassis in enterprise fleets.

Detection Strategies

Validate the Patch Level reported by Android devices against the February 2025 MediaTek bulletin fix for Issue ID MSV-2434.
Use mobile device management (MDM) telemetry to flag devices that report unknown bootloader states, unlocked bootloaders, or failed attestation.
For OpenWrt, RDK-B, and Yocto-based devices, inventory firmware builds and compare against vendor-supplied patched builds that incorporate the MediaTek fix.

Monitoring Recommendations

Monitor MDM and endpoint telemetry for Play Integrity or SafetyNet attestation failures that may indicate tampered firmware.
Track physical custody events for high-value devices and alert on unaccounted-for return-to-service cycles.
Ingest MDM, bootloader, and firmware integrity logs into a centralized SIEM for correlation across the fleet.

How to Mitigate CVE-2025-20635

Immediate Actions Required

Apply the vendor patch identified by Patch ID ALPS09403752 once the device OEM distributes a firmware update containing the February 2025 MediaTek fix.
Inventory all devices built on the affected MediaTek chipsets, including Android handsets, OpenWrt routers, and RDK-B gateways.
Restrict physical access to production and high-value devices and enforce chain-of-custody controls during repair or RMA.

Patch Information

MediaTek published the fix in its February 2025 Product Security Bulletin under Patch ID ALPS09403752 and Issue ID MSV-2434. Downstream vendors including Google, OpenWrt, RDK-B, and Yocto distributors must integrate the patch and ship updated firmware. Confirm patch delivery through the MediaTek Security Bulletin February 2025 and the OEM's security update channel.

Workarounds

Lock bootloaders and disable unauthorized download or BROM mode entry on production devices.
Enforce device attestation policies through MDM and quarantine devices that fail integrity checks.
Decommission end-of-life devices that will not receive the MediaTek February 2025 patch from the OEM.

bash

# Verify Android security patch level against the MediaTek February 2025 bulletin
adb shell getprop ro.build.version.security_patch