CVE-2025-20746

Description

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.

CVSS Details

CVSS Score

6.7

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:* - NOT VULNERABLE

MediaTek芯片（搭载GNSS服务且未安装ALPS10010441补丁的版本）

受影响Android设备（使用MediaTek芯片且系统版本较旧）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-20746 PoC - MediaTek GNSS Service Out of Bounds Write
// Note: This PoC demonstrates the vulnerability concept
// Actual exploitation requires System privilege

// Vulnerable code pattern (pseudo-code)
void gnss_service_handler(char* input, int length) {
    char buffer[256];  // Bounded buffer
    
    // Incorrect bounds check - allows writing beyond buffer
    if (length < 512) {  // Should be: length <= 256
        memcpy(buffer, input, length);  // OOB write occurs here
    }
}

// Exploitation steps:
// 1. Obtain System privilege on affected device
// 2. Access GNSS service interface
// 3. Send crafted input exceeding buffer boundary
// 4. Trigger OOB write to corrupt memory
// 5. Achieve privilege escalation

// Detection method:
// Monitor for unexpected GNSS service crashes or memory corruption
// Check for unauthorized privilege changes in system logs

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-20746
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-20746
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-20746/
[4] VulDB https://vuldb.com/cve/CVE-2025-20746
[5] https://corp.mediatek.com/product-security-bulletin/November-2025

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-20746", "sourceIdentifier": "[email protected]", "published": "2025-11-04T07:15:48.700", "lastModified": "2025-11-05T17:11:34.660", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "437D8F9D-67DF-47A5-9C96-5B51D1562951"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*", "matchCriteriaId": "CB397DA1-62B3-48FD-B694-9FDA4DA25EDE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*", "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*", "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:openwrt:openwrt:23.05.0:-:*:*:*:*:*:*", "matchCriteriaId": "00113669-2850-4F0C-913A-92CA5290746E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:zephyrproject:zephyr:3.7.0:-:*:*:*:*:*:*", "matchCriteriaId": "8FA9F6FC-E722-428B-BB01-E9082DBF9A32"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*", "matchCriteriaId": "F5506327-7DDF-4E88-9EA8-10B8E32F848B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*", "matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*", "matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*", "matchCriteriaId": "DFB497BE-A045-4673-874C-7337E62CC606"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6986d:-:*:*:*:*:*:*:*", "matchCriteriaId": "68AA1CF7-F1CB-44A0-980E-DB32D9E379B9"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*", "matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*", "matchCriteriaId": "1CF88096-5CBD-4A4B-8F47-33D38985956F"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*", "matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}], "references": [{"url": "https://corp.mediatek.com/pr ... (truncated)