CVE-2023-32890 Denial of service in MT2731, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT8666, MT8667, MT8765, MT8766, MT8768, MT8786, MT8788

Medium 5.9 Published 2 Jan 2024 Updated 2 Aug 2024

Remote attackers can cause a system crash in MediaTek modem firmware via improper input validation without user interaction or privileges.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-32890?

CVE-2023-32890 is a medium-severity denial of service vulnerability in Mediatek Nr15, published on 2 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01183647; Issue ID: MOLY01183647 (MSV-963).

Weakness: CWE-20

Which versions are affected by CVE-2023-32890?

It affects 4 products.

Products include Mediatek Lr13, Mediatek Nr15, Mediatek Nr16, Mediatek Nr17.

How do I fix CVE-2023-32890?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-32890 being exploited?

There is no known exploitation of CVE-2023-32890 in the wild and no public exploit code.

CVE-2023-32874 Memory corruption in MT2735, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990 Critical 9.8

All Mediatek Nr15 vulnerabilities

Sources

Also known as A-323469023, ASB-A-323469023, GHSA-cpmr-p9r8-5m73, M-MOLY01183647.