CVE-2020-0069 KEV
7.8
HIGH · CVSS 3.1 · EPSS 1.4% (pctl 71)
Patch first
On CISA KEV — known exploited in the wild, due 2022-05-03.
Description
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Scoring
| CVSS | 7.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 1.37% — more likely to be exploited than 71% of all CVEs |
| Weakness | CWE-787 |
| On CISA KEV | yes — remediate by 2022-05-03 |
| Public exploit | none known |
| Published | 2020-03-10 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability |
|---|---|
| Added | 2021-11-03 |
| Due | 2022-05-03 |
| Vendor / product | MediaTek / Multiple Chipsets |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| android | |
| huawei | berkeley-l09 |
| huawei | berkeley-l09 firmware |
| huawei | columbia-al10b |
| huawei | columbia-al10b firmware |
| huawei | columbia-l29d |
| huawei | columbia-l29d firmware |
| huawei | columbia-tl00b |
| huawei | columbia-tl00b firmware |
| huawei | columbia-tl00d |
| huawei | columbia-tl00d firmware |
| huawei | cornell-al00a |
| huawei | cornell-al00a firmware |
| huawei | cornell-tl10b |
| huawei | cornell-tl10b firmware |
| huawei | dura-al00a |
| huawei | dura-al00a firmware |
| huawei | honor 20 pro |
| huawei | honor 20 pro firmware |
| huawei | honor 8a |
| huawei | honor 8a firmware |
| huawei | honor view 20 |
| huawei | honor view 20 firmware |
| huawei | jakarta-al00a |
| huawei | jakarta-al00a firmware |
| huawei | katyusha-al00a |
| huawei | katyusha-al00a firmware |
| huawei | katyusha-al10a |
| huawei | katyusha-al10a firmware |
| huawei | madrid-al00a |
| huawei | madrid-al00a firmware |
| huawei | nova 3 |
| huawei | nova 3 firmware |
| huawei | nova 4 |
| huawei | nova 4 firmware |
| huawei | paris-l29b |
| huawei | paris-l29b firmware |
| huawei | princeton-al10b firmware |
| huawei | y6 2019 |
| huawei | y6 2019 firmware |
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en
- https://source.android.com/security/bulletin/2020-03-01
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en
- https://source.android.com/security/bulletin/2020-03-01
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069
→ the Explorer · watch your stack · NVD