CVE-2020-0069 Mediatek Multiple Chipsets Insufficient Input Validation
Local attackers can escalate privileges via an out-of-bounds write in the Mediatek Command Queue driver due to insufficient input sanitization.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-0069?
CVE-2020-0069 is a high-severity memory corruption vulnerability in Google Android, published on 10 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Weakness: CWE-787
Which versions are affected by CVE-2020-0069?
It affects 29 products.
Products include Google Android, Huawei Berkeley-L09 Firmware, Huawei Columbia-Al10b Firmware, Huawei Columbia-L29d Firmware, Huawei Columbia-Tl00b Firmware, Huawei Columbia-Tl00d Firmware and 23 more.
How do I fix CVE-2020-0069?
No fix has been published for CVE-2020-0069 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-0069 being exploited?
Yes. Attackers have exploited CVE-2020-0069 in the wild since at least 3 Nov 2021.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-xx48-fp29-wh9j.