CVE-2020-0069
Last modified
CVE-2020-0069 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. CISA has confirmed active exploitation in the wild. EPSS estimates a 1.30% chance of exploitation in the next 30 days.
Description
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | All versions | |
| Huawei | Berkeley-L09 Firmware | < 10.0.0.177\(c10e3r1p4\) |
| Huawei | Columbia-Al10b Firmware | < 10.0.0.178\(c00e178r1p4\) |
| Huawei | Columbia-L29d Firmware | < 10.0.0.177\(c10e4r1p4\) |
| Huawei | Columbia-Tl00b Firmware | < 10.0.0.178\(c01e178r1p4\) |
| Huawei | Columbia-Tl00d Firmware | < 10.0.0.178\(c01e178r1p4\) |
| Huawei | Cornell-Al00a Firmware | < 9.1.0.340\(c00e333r1p1t8\) |
| Huawei | Cornell-Tl10b Firmware | < 9.1.0.340\(c01e333r1p1t8\) |
| Huawei | Dura-Al00a Firmware | < 1.0.0.190\(c00\) |
| Huawei | Honor 20 Pro Firmware | < 10.0.0.194\(c636e3r3p1\) |
| Huawei | Y6 2019 Firmware | < 9.1.0.290\(c185e5r4p1\) |
| Huawei | Nova 3 Firmware | < 9.1.0.338\(c00e333r1p1t8\) |
| Huawei | Nova 4 Firmware | < 10.0.0.160\(c01e32r2p4\) |
| Huawei | Honor 8a Firmware | < 9.1.0.291\(c185e3r4p1\) |
| Huawei | Honor View 20 Firmware | < 10.0.0.198\(c432e10r3p4\) |
| Huawei | Jakarta-Al00a Firmware | < 9.1.0.251\(c00e106r2p2\) |
| Huawei | Katyusha-Al00a Firmware | < 9.1.0.146\(c00e131r2p2\) |
| Huawei | Katyusha-Al10a Firmware | < 9.1.0.160\(c00e150r1p7\) |
| Huawei | Madrid-Al00a Firmware | < 9.1.0.261\(c00e120r4p1\) |
| Huawei | Paris-L29b Firmware | < 9.1.0.380\(c636e1r1p3t8\) |
| Huawei | Princeton-Al10b Firmware | < 10.0.0.194\(c00e61r4p11\) |
| Huawei | Sydney-Al00 Firmware | < 9.1.0.237\(c00e80r1p7t8\) |
| Huawei | Sydney-Tl00 Firmware | < 9.1.0.237\(c01e80r1p7t8\) |
| Huawei | Sydneym-Al00 Firmware | < 10.0.0.159\(c00e64r1p5\) |
| Huawei | Tony-Al00b Firmware | < 10.1.0.137\(c00e137r2p11\) |
| Huawei | Tony-Tl00b Firmware | < 10.0.0.196\(c01e65r2p11\) |
| Huawei | Yale-Al00a Firmware | < 10.0.0.196\(c00e62r8p12\) |
| Huawei | Yale-L21a Firmware | < 10.0.0.202\(c10e3r3p2\) |
| Huawei | Yalep-Al10b Firmware | < 10.0.0.194\(c00e62r8p12\) |
| Huawei | Columbia-L29d Firmware | < 10.0.0.177\(c432e3r1p4\) |
| Huawei | Honor 20 Pro Firmware | < 10.0.0.202\(c10e3r3p2\) |
| Huawei | Y6 2019 Firmware | < 9.1.0.290\(c431e1r1p8\) |
| Huawei | Y6 2019 Firmware | < 9.1.0.290\(c605e6r1p6\) |
| Huawei | Y6 2019 Firmware | < 9.1.0.295\(c431e5r2p2\) |
| Huawei | Honor 8a Firmware | < 9.1.0.291\(c432e5r2p1\) |
| Huawei | Honor 8a Firmware | < 9.1.0.291\(c636e4r4p1\) |
| Huawei | Honor 8a Firmware | < 9.1.0.297\(c605e4r4p2\) |
| Huawei | Honor View 20 Firmware | < 10.0.0.200\(c185e3r3p3\) |
| Huawei | Honor View 20 Firmware | < 10.0.0.201\(c10e5r4p3\) |
References
- https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
- https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2020-0069?
How severe is CVE-2020-0069?
How do I fix CVE-2020-0069?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-0063In SurfaceFlinger, it is possible to override UI confirmatio…7.3
- CVE-2020-0064An improper authorization while processing the provisioning …5.5
- CVE-2020-0065An improper authorization in the receiver component of the A…5.5
- CVE-2020-0066In the netlink driver, there is a possible out of bounds wri…6.4
- CVE-2020-0067In f2fs_xattr_generic_list of xattr.c, there is a possible o…4.4
- CVE-2020-0068In crus_afe_get_param of msm-cirrus-playback.c, there is a p…4.4
- CVE-2020-0070In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is…9.8
- CVE-2020-0071In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, ther…9.8
- CVE-2020-0072In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is …9.8
- CVE-2020-0073In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is …9.8
- CVE-2020-0074In verifyIntentFiltersIfNeeded of PackageManagerService.java…7.8
- CVE-2020-0075In set_shared_key of the FPC IRIS TrustZone app, there is a …4.4
Are you affected by CVE-2020-0069?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST