CVE-2020-0069
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds...
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
- Record
CVE-2020-0069- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
- Record
CVE-2020-0069- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2020-1576
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
- Record
EUVD-2020-1576- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xx48-fp29-wh9j
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds...
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
- Record
GHSA-xx48-fp29-wh9j- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CISA KEV No score
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
- Record
CVE-2020-0069- Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
- google android
- huawei berkeley-l09 firmware
- huawei columbia-al10b firmware
- huawei columbia-l29d firmware
- huawei columbia-tl00b firmware
- huawei columbia-tl00d firmware
- huawei cornell-al00a firmware
- huawei cornell-tl10b firmware
- huawei dura-al00a firmware
- huawei honor 20 pro firmware
- huawei honor 8a firmware
- huawei honor view 20 firmware
Show 18 moreShow less
- huawei jakarta-al00a firmware
- huawei katyusha-al00a firmware
- huawei katyusha-al10a firmware
- huawei madrid-al00a firmware
- huawei nova 3 firmware
- huawei nova 4 firmware
- huawei paris-l29b firmware
- huawei princeton-al10b firmware
- huawei sydney-al00 firmware
- huawei sydney-tl00 firmware
- huawei sydneym-al00 firmware
- huawei tony-al00b firmware
- huawei tony-tl00b firmware
- huawei y6 2019 firmware
- huawei yale-al00a firmware
- huawei yale-l21a firmware
- huawei yalep-al10b firmware
- mediatek multiple chipsets
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | R0rt1z2/AutomatedRoot | 2019-09-06 |
| PoC in GitHub | TheRealJunior/mtk-su-reverse-cve-2020-0069 | 2020-03-03 |
| PoC in GitHub | quarkslab/CVE-2020-0069_poc | 2020-03-24 |
| PoC in GitHub | 0xf15h/mtk_su | 2023-09-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-0069 is a high vulnerability (CVSS 7.8) in Google Android, published March 10, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. No source names a fixed version.