MediaTek rings in the new year with a parade of chipset vulns

MediaTek disclosed a set of security vulnerabilities, most notably CVE-2024-20154 — a critical modem stack overflow enabling unauthenticated remote code execution via attacker-controlled base stations — affecting many chipsets used in smartphones, IoT devices, cars, and Chromebooks; vendors were notified and patches were issued before public disclosure, and additional high- and medium-severity issues (including privilege escalation, DoS, and information disclosure) were also addressed.