Known Exploited Vulnerability
7.8
HIGH
CVE-2020-0069
Mediatek Multiple Chipsets Insufficient Input Vali - [Actively Exploited]
Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

INFO

Published Date :

March 10, 2020, 8:15 p.m.

Last Modified :

July 25, 2024, 2:32 p.m.

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."

Required Action :

Apply updates per vendor instructions.

Public PoC/Exploit Available at Github

CVE-2020-0069 has a 14 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2020-0069 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Huawei honor_20_pro_firmware
2 Huawei yale-l21a_firmware
3 Huawei honor_8a_firmware
4 Huawei berkeley-l09_firmware
5 Huawei columbia-al10b_firmware
6 Huawei columbia-l29d_firmware
7 Huawei cornell-al00a_firmware
8 Huawei honor_view_20_firmware
9 Huawei paris-l29b_firmware
10 Huawei sydney-al00_firmware
11 Huawei sydneym-al00_firmware
12 Huawei columbia-tl00d_firmware
13 Huawei cornell-tl10b_firmware
14 Huawei dura-al00a_firmware
15 Huawei y6_2019_firmware
16 Huawei nova_3_firmware
17 Huawei nova_4_firmware
18 Huawei jakarta-al00a_firmware
19 Huawei katyusha-al00a_firmware
20 Huawei madrid-al00a_firmware
21 Huawei princeton-al10b_firmware
22 Huawei sydney-tl00_firmware
23 Huawei tony-al00b_firmware
24 Huawei tony-tl00b_firmware
25 Huawei yale-al00a_firmware
26 Huawei yalep-al10b_firmware
27 Huawei columbia-tl00b_firmware
28 Huawei berkeley-l09
29 Huawei columbia-l29d
30 Huawei cornell-tl10b
31 Huawei dura-al00a
32 Huawei nova_3
33 Huawei honor_view_20
34 Huawei jakarta-al00a
35 Huawei princeton-al10b
36 Huawei sydney-al00
37 Huawei sydney-tl00
38 Huawei sydneym-al00
39 Huawei tony-al00b
40 Huawei tony-tl00b
41 Huawei yale-al00a
42 Huawei yale-l21a
43 Huawei columbia-al10b
44 Huawei columbia-tl00b
45 Huawei columbia-tl00d
46 Huawei cornell-al00a
47 Huawei honor_20_pro
48 Huawei y6_2019
49 Huawei nova_4
50 Huawei honor_8a
51 Huawei katyusha-al00a
52 Huawei katyusha-al10a_firmware
53 Huawei katyusha-al10a
54 Huawei madrid-al00a
55 Huawei paris-l29b
56 Huawei yalep-al10b
1 Google android
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2020-0069.

URL Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en Vendor Advisory
https://source.android.com/security/bulletin/2020-03-01 Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 16, 2024, 5:20 a.m. This repo has been linked 1 different CVEs too.

All CVE - PoC in GitHub

poc proofofconcept tester allcve cvegithub cvenew cvepoc cveupdate

Updated: 2 months, 3 weeks ago
5 stars 2 fork 2 watcher
Born at : March 22, 2024, 3:58 p.m. This repo has been linked 928 different CVEs too.

CVE-2020-0069

CMake C++

Updated: 4 months ago
7 stars 2 fork 2 watcher
Born at : Sept. 4, 2023, 5:52 p.m. This repo has been linked 1 different CVEs too.

A curated list of my GitHub stars!

Updated: 1 year, 3 months ago
0 stars 0 fork 0 watcher
Born at : Aug. 3, 2023, 6:43 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 4 months, 3 weeks ago
8 stars 1 fork 1 watcher
Born at : June 21, 2022, 7:45 a.m. This repo has been linked 943 different CVEs too.

None

Python Shell

Updated: 2 years, 5 months ago
0 stars 0 fork 0 watcher
Born at : June 16, 2022, 12:19 a.m. This repo has been linked 1 different CVEs too.

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 months, 2 weeks ago
516 stars 32 fork 32 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1181 different CVEs too.

None

Updated: 8 months, 2 weeks ago
33 stars 3 fork 3 watcher
Born at : March 12, 2021, 12:22 p.m. This repo has been linked 1063 different CVEs too.

None

Updated: 1 year, 3 months ago
17 stars 10 fork 10 watcher
Born at : Jan. 2, 2021, 10:19 p.m. This repo has been linked 1050 different CVEs too.

None

Updated: 3 months ago
82 stars 32 fork 32 watcher
Born at : Oct. 2, 2020, 2:49 p.m. This repo has been linked 1111 different CVEs too.

None

exploit mediatek android

Makefile C C++ Shell

Updated: 3 months, 1 week ago
97 stars 26 fork 26 watcher
Born at : March 24, 2020, 1:10 p.m. This repo has been linked 1 different CVEs too.

simple poc for CVE-2020-0069

Updated: 4 years, 8 months ago
0 stars 0 fork 0 watcher
Born at : March 7, 2020, 8:50 a.m. This repo has been linked 1 different CVEs too.

reversing mtk-su

Python Makefile C C++

Updated: 3 months, 1 week ago
16 stars 5 fork 5 watcher
Born at : March 3, 2020, 10:55 p.m. This repo has been linked 1 different CVEs too.

Root your MediaTek device with CVE-2020-0069

mtk-su android cve-2020-0069 mediatek

Shell Python

Updated: 2 months, 3 weeks ago
144 stars 21 fork 21 watcher
Born at : Sept. 6, 2019, 12:12 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2020-0069 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2020-0069 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Jul. 25, 2024

    Action Type Old Value New Value
    Changed Reference Type http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en No Types Assigned http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en Vendor Advisory
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.177\(c10e3r1p4\) OR cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:columbia-al10b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.178\(c00e178r1p4\) OR cpe:2.3:h:huawei:columbia-al10b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.177\(c10e4r1p4\) OR cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.178\(c01e178r1p4\) OR cpe:2.3:h:huawei:columbia-tl00b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:columbia-tl00d_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.178\(c01e178r1p4\) OR cpe:2.3:h:huawei:columbia-tl00d:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:cornell-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.340\(c00e333r1p1t8\) OR cpe:2.3:h:huawei:cornell-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.340\(c01e333r1p1t8\) OR cpe:2.3:h:huawei:cornell-tl10b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.190\(c00\) OR cpe:2.3:h:huawei:dura-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.194\(c636e3r3p1\) OR cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.290\(c185e5r4p1\) OR cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.338\(c00e333r1p1t8\) OR cpe:2.3:h:huawei:nova_3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:nova_4_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.160\(c01e32r2p4\) OR cpe:2.3:h:huawei:nova_4:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.291\(c185e3r4p1\) OR cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.198\(c432e10r3p4\) OR cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.251\(c00e106r2p2\) OR cpe:2.3:h:huawei:jakarta-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:katyusha-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.146\(c00e131r2p2\) OR cpe:2.3:h:huawei:katyusha-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:katyusha-al10a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.160\(c00e150r1p7\) OR cpe:2.3:h:huawei:katyusha-al10a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:madrid-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.261\(c00e120r4p1\) OR cpe:2.3:h:huawei:madrid-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:paris-l29b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.380\(c636e1r1p3t8\) OR cpe:2.3:h:huawei:paris-l29b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.194\(c00e61r4p11\) OR cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.237\(c00e80r1p7t8\) OR cpe:2.3:h:huawei:sydney-al00:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.237\(c01e80r1p7t8\) OR cpe:2.3:h:huawei:sydney-tl00:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.159\(c00e64r1p5\) OR cpe:2.3:h:huawei:sydneym-al00:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.1.0.137\(c00e137r2p11\) OR cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.196\(c01e65r2p11\) OR cpe:2.3:h:huawei:tony-tl00b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.196\(c00e62r8p12\) OR cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.202\(c10e3r3p2\) OR cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.194\(c00e62r8p12\) OR cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.177\(c432e3r1p4\) OR cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.202\(c10e3r3p2\) OR cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.290\(c431e1r1p8\) OR cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.290\(c605e6r1p6\) OR cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.295\(c431e5r2p2\) OR cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.291\(c432e5r2p1\) OR cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.291\(c636e4r4p1\) OR cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 9.1.0.297\(c605e4r4p2\) OR cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.200\(c185e3r3p3\) OR cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.0.201\(c10e5r4p3\) OR cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    May. 27, 2020

    Action Type Old Value New Value
    Added Reference http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en [No Types Assigned]
  • Initial Analysis by [email protected]

    Mar. 11, 2020

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:L/AC:L/Au:N/C:C/I:C/A:C)
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://source.android.com/security/bulletin/2020-03-01 No Types Assigned https://source.android.com/security/bulletin/2020-03-01 Vendor Advisory
    Added CWE NIST CWE-787
    Added CPE Configuration OR *cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2020-0069 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2020-0069 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.14 }} 0.03%

score

0.50379

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability