Security researchers have uncovered new vulnerabilities in a popular Android chip, which could have allowed threatening actors to snoop on the sound of nearly two-fifths (37%) of the world’s smartphones.
CVE-2021-0661, CVE-2021-0662 and CVE-2021-0663 were fixed by the Taiwanese microchip company MediaTek in their October bulletin following responsible publication by Check Point Research. A fourth issue, CVE-2021-0673, was corrected in October and will be published in the December Bulletin.
The Check Point team said it reverse engineered one of the key components of the chip, the digital audio signal processor (DSP), which is implemented to reduce CPU usage and improve media performance.
Those errors can be exploited if the user downloads a malicious app.
That app would theoretically then utilize the MediaTek API to attack a library of permissions to talk to the audio driver. Since the app has system privileges, it will then be able to send crafted messages to the driver to execute code in the firmware on the audio DSP, Check Point said.
This would allow remote attackers to eavesdrop on audio conversations.
MediaTek’s chip is the main processor for “almost all notable Android devices,” including several Chinese manufacturers, including Xiaomi, Oppo, Realme and Vivo, according to Check Point.
“Inadvertently, a hacker could have potentially exploited the vulnerabilities to eavesdrop on conversations with Android users. Furthermore, the security flaws could have been exploited by the device manufacturers themselves to create a massive eavesdropping campaign,” warned Check Point security researcher Slava Makkaveev.
“Although we do not see any specific evidence of such abuse, we went quickly to disclose our findings to MediaTek and Xiaomi.”
Tiger Hsu, Product Safety Manager at MediaTek, urged all users to update their handsets when patches become available, but did much to point out that there is no evidence that the bugs are currently being exploited.
“Device security is a critical component and priority for all MediaTek platforms,” he added. “Regarding the audio DSP vulnerability revealed by Check Point, we worked diligently to validate the issue and make appropriate remedies available to all OEMs.”