Apple-made audio codec presents critical vulnerabilities in millions of Android phones

An open source audio codec developed by Apple is affected by serious vulnerabilities that have been pushed to millions of Android devices by some of the world’s largest mobile chipset makers.

Apple Lossless Audio Codec (ALAC) was introduced by Apple in 2004 and in 2011, the tech giant decided to make ALAC open source. The open source ALAC code has been picked up by several other vendors for non-Apple devices.

Apple has continued to improve the proprietary version of the codec, but the open source code has never been updated over the past 11 years and it appears that third-party vendors using that code have made efforts to ensure Didn’t say it’s safe.

Researchers from cyber security firm Check Point found that open source ALAC code is affected by serious vulnerabilities, and that at least two major mobile chipset makers – Qualcomm and MediaTek – have used it for their audio decoders.

Qualcomm and MediaTek hold significant market share and Check Point believes that millions of smartphones around the world were vulnerable to attacks because of the use of the ALAC codec.

The security firm estimates that the flaws found by its researchers — the vulnerabilities dubbed ALHACK — put the privacy of about two-thirds of Android users at risk.

Vulnerabilities can be triggered using specially crafted audio files and they can lead to remote code execution.

“The impact of an RCE vulnerability could range from malware execution to an attacker gaining control of a user’s multimedia data, including streaming from a compromised machine’s camera,” Check Point explained in a blog post published Thursday. In addition, an unprivileged Android app could exploit these vulnerabilities to elevate its privileges and gain access to media data and user conversations.

The MediaTek vulnerabilities patched in December 2021 have been identified as CVE-2021-0675 and CVE-2021-0674 and given “high” and “moderate” severity ratings. Qualcomm also released the patches in December 2021. The Qualcomm defect is tracked as CVE-2021-30351 and given a “Critical” severity rating.

Check Point plans to disclose the technical details at the CanSackWest conference next month.

RELATED: Google exploits Android Zero-Day in targeted attacks

RELATED: 44 Vulnerabilities Patched in Android with April 2022 Security Update

Eduard Kovacs (@EduardKovacs) is a contributing editor to SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as a security news reporter for Softpedia. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in applied computer technologies in electrical engineering. Previous column by Eduard Kovacs:tag:

Source