Critical bug in decoder used by popular chipsets exposes 2/3 of Android devices to hack

A critical RCE flaw in Android devices running on Qualcomm and MediaTek chipsets could allow access to users’ media files.

Security researchers at Check Point Research have discovered a critical remote code execution that affects the implementation of the Apple Lossless Audio Codec (ALAC) in Android devices running on Qualcomm and MediaTek chipsets.

The ALAC is an audio coding format developed by Apple for lossless data compression of digital music.

ALAC was developed in 2004 and Apple open-sourced it in 2011, since then many third-party vendors used it. Check Point Research reported that Qualcomm and MediaTek chipset makers used a vulnerable version of the ALAC code in their audio decoders, the security firm estimated that more than half of all smartphones worldwide are impacted. 

A remote attacker can trigger the vulnerability by tricking the target device into opening a malformed audio file to execute arbitrary code.

“The impact of an RCE vulnerability can range from malware execution to an attacker gaining control over a user’s multimedia data, including streaming from a compromised machine’s camera.” reads the post published by CheckPoint. “In addition, an unprivileged Android app could use these vulnerabilities to escalate its privileges and gain access to media data and user conversations.”

The security firm responsibly shared its findings with MediaTek and Qualcomm and helped them to fix it.

MediaTek tracked the ALAC flaws as CVE-2021-0674 and CVE-2021-0675, while Qualcomm tracked it as CVE-2021-30351.

Both chipset makers addressed the issues in December 2021.

CheckPoint researchers did not disclose details of the flaw to avoid its exploitation in the wild, however, they plan to present their findings during the upcoming CanSecWest in May 2022.

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Android)