CVE-2020-0069
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Description
CVE-2020-0069 is a high-severity out-of-bounds write vulnerability affecting multiple MediaTek chipsets through insufficient input sanitization and missing SELinux restrictions in the Command Queue driver's ioctl handlers. The vulnerability allows local privilege escalation with no additional execution privileges needed and no user interaction required. CISA has added CVE-2020-0069 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under the "AbstractEmu" exploit chain. The EPSS score of 0.71% (72.0th percentile) indicates a moderate probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | - | |
| huawei | berkeley-l09 firmware | < 10.0.0.177\(c10e3r1p4\) |
| huawei | columbia-al10b firmware | < 10.0.0.178\(c00e178r1p4\) |
| huawei | columbia-l29d firmware | < 10.0.0.177\(c10e4r1p4\); < 10.0.0.177\(c432e3r1p4\) |
| huawei | columbia-tl00b firmware | < 10.0.0.178\(c01e178r1p4\) |
| huawei | columbia-tl00d firmware | < 10.0.0.178\(c01e178r1p4\) |
| huawei | cornell-al00a firmware | < 9.1.0.340\(c00e333r1p1t8\) |
| huawei | cornell-tl10b firmware | < 9.1.0.340\(c01e333r1p1t8\) |
| huawei | dura-al00a firmware | < 1.0.0.190\(c00\) |
| huawei | honor 20 pro firmware | < 10.0.0.194\(c636e3r3p1\); < 10.0.0.202\(c10e3r3p2\) |
| huawei | y6 2019 firmware | < 9.1.0.290\(c185e5r4p1\); < 9.1.0.290\(c431e1r1p8\); < 9.1.0.290\(c605e6r1p6\); < 9.1.0.295\(c431e5r2p2\) |
| huawei | nova 3 firmware | < 9.1.0.338\(c00e333r1p1t8\) |
| huawei | nova 4 firmware | < 10.0.0.160\(c01e32r2p4\) |
| huawei | honor 8a firmware | < 9.1.0.291\(c185e3r4p1\); < 9.1.0.291\(c432e5r2p1\); < 9.1.0.291\(c636e4r4p1\); < 9.1.0.297\(c605e4r4p2\) |
| huawei | honor view 20 firmware | < 10.0.0.198\(c432e10r3p4\); < 10.0.0.200\(c185e3r3p3\); < 10.0.0.201\(c10e5r4p3\) |
| huawei | jakarta-al00a firmware | < 9.1.0.251\(c00e106r2p2\) |
| huawei | katyusha-al00a firmware | < 9.1.0.146\(c00e131r2p2\) |
| huawei | katyusha-al10a firmware | < 9.1.0.160\(c00e150r1p7\) |
| huawei | madrid-al00a firmware | < 9.1.0.261\(c00e120r4p1\) |
| huawei | paris-l29b firmware | < 9.1.0.380\(c636e1r1p3t8\) |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en(Vendor Advisory)
- https://source.android.com/security/bulletin/2020-03-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069(Third Party Advisory, US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In the MediaTek Command Queue driver, the out-of-bounds write occurs due to insufficient input sanitization in the ioctl handlers combined with missing SELinux restrictions. This allows an attacker to write data beyond the intended buffer boundaries in kernel memory, corrupting adjacent data structures and enabling privilege escalation from an unprivileged application to kernel level.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-0069 carries a CVSS 3.1 score of 7.8 (HIGH), representing a serious local privilege escalation threat affecting a wide range of Android devices with MediaTek chipsets. The vulnerability is locally exploitable with low complexity, requiring only low privileges and no user interaction. Successful exploitation fully compromises confidentiality, integrity, and availability at the kernel level, allowing attackers to gain root access from any installed application. The combination of missing SELinux restrictions and insufficient input validation in the Command Queue driver creates a particularly accessible attack surface. When chained with CVE-2019-2215 and CVE-2020-0041 in the AbstractEmu exploit chain, this vulnerability contributes to complete device compromise across Android devices from multiple manufacturers including Huawei.
Exploit Maturity
CVE-2020-0069 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was observed as a component of the "AbstractEmu" exploit chain, chained with CVE-2019-2215 (a binder use after free) and CVE-2020-0041 (a binder out-of-bounds write) to achieve full privilege escalation on Android devices with MediaTek chipsets. The EPSS score of 0.71% (72.0th percentile) indicates a moderate but real probability of exploitation. The widespread use of MediaTek chipsets across budget and mid-range Android devices significantly expands the potential attack surface for this vulnerability.
Remediation
- Apply vendor security updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Google addressed this vulnerability in the March 2020 Android Security Bulletin, and Huawei released patches for multiple affected device models.
- Update all affected Android devices, particularly those with MediaTek chipsets, to the latest available security patches. Huawei devices should be updated to the firmware versions specified in the Huawei Security Advisory SA-20200527-01.
- For devices that no longer receive security updates, implement strict application management policies to prevent installation of untrusted applications that could exploit this local privilege escalation vulnerability.
- Deploy network-level monitoring for indicators of the AbstractEmu exploit chain, and audit installed applications on managed devices for known malicious packages associated with this exploit framework.
- Consider device replacement for MediaTek-based devices that no longer receive security updates, particularly in enterprise environments where device compromise could lead to access to corporate resources.
Technical Details
CVE-2020-0069 is an out-of-bounds write vulnerability in the MediaTek Command Queue driver's ioctl handlers within the Android Kernel. The vulnerability has two contributing factors: insufficient input sanitization in the ioctl handlers and missing SELinux restrictions that should have limited access to the vulnerable driver. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local exploitation with low privileges, low complexity, and no user interaction. The CWE-787 (Out-of-bounds Write) classification reflects the core vulnerability mechanism where unchecked input allows writes beyond buffer boundaries in kernel memory. The missing SELinux policies are significant because they remove an important defense-in-depth layer that would normally restrict which processes can interact with the Command Queue driver, expanding the attack surface to any application on the device.
Frequently Asked Questions
Is CVE-2020-0069 being actively exploited?
Yes. CVE-2020-0069 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It was observed as part of the AbstractEmu exploit chain targeting Android devices with MediaTek chipsets, combined with CVE-2019-2215 and CVE-2020-0041.
What products are affected by CVE-2020-0069?
CVE-2020-0069 affects Google Android devices with MediaTek chipsets and multiple Huawei devices including Berkeley, Columbia, Cornell, Honor 20 Pro, Honor 8A, Honor View 20, Nova 3, Nova 4, Y6 2019, and several other models with specific firmware versions.
How do I fix CVE-2020-0069?
Apply the Android security updates from the March 2020 Security Bulletin. For Huawei devices, apply the firmware updates specified in Huawei Security Advisory SA-20200527-01. For devices no longer receiving updates, restrict app installation to trusted sources and consider device replacement.
How severe is CVE-2020-0069?
CVE-2020-0069 has a CVSS 3.1 score of 7.8 (HIGH) and an EPSS score of 0.71% (72.0th percentile). The vulnerability enables kernel-level privilege escalation on devices with MediaTek chipsets and is used in the AbstractEmu exploit chain for complete device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.