Three Security Vulnerabilities In The Audio Decoders Affects Millions Of Android Devices

Three security vulnerabilities have been reported in the audio decoders of MediaTek and Qualcomm chips. If left unresolved, these vulnerabilities could allow criminals to remotely access media and audio conversations from compromised devices. According to Israeli cybersecurity company Check Point, these vulnerabilities could be utilized as a launchpad to carry out RCE attacks by sending a specially crafted audio file. Therefore, there is a need to fix these vulnerabilities. This article will discuss protecting your Android device from these three security vulnerabilities in the audio decoders affecting millions of Android devices.

About Apple Lossless Audio Codec

The vulnerabilities rooted in an audio coding format were originally developed and open-sourced by Apple in 2011. The audio codec format, known as Apple Lossless Audio Codec (ALAC), is used for digital music lossless data compression. 

Since then, various third-party vendors like MediaTek and Qualcomm have incorporated the Apple-supplied audio codec implementation as a cornerstone for their audio decoders. While Apple has consistently patched and rectified security flaws in ALAC proprietary versions, the open-source code variant has not received any update since it was uploaded to GitHub 11 years ago. 

List Of Security Vulnerabilities In The Audio Decoders

The vulnerabilities detected by Check Point are relevant to the ported ALAC code. One of these is found in Qualcomm chipsets and two in MediaTek.

Summary Of Security Vulnerabilities In The Audio Decoders

Here are summaries of all three security vulnerabilities in the audio decoder.

CVE-2021-0674

In the ALAC decoder, there is a possible out-of-bounds read due to incorrect bounds check. It could lead to local information disclosure without requiring additional privileges. Moreover, user interaction is not required for exploitation.

CVE-2021-0675

In the ALAC decoder, there is a possible out-of-bounds write due to incorrect bounds check. It could lead to local privilege escalation without requiring additional execution privileges. Moreover, user interaction is not required for exploitation.

CVE-2021-30351

An out of bounds memory access can happen due to improper validation of a number of frames passed during music playback in Snapdragon Compute, Snapdragon Auto, Snapdragon Consumer IoT, Snapdragon Connectivity, Snapdragon mobile, Snapdragon Industrial IoT, Snapdragon Wearables, Snapdragon Voice & Music, Snapdragon Wire Infrastructure and Networking.

Tips To Secure Your Android Phone

Here are some tips to secure your android devices.

By following these tips, you can help keep your Android device safe from potential threats

We hope this post would help you know about Three Security Vulnerabilities in the Audio Decoders that Affects Millions of Android Devices. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.