NetSight
IP …
high7.8Known exploited

CVE-2020-0069

Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Impact

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Affected products

VendorProductAffected versions
GoogleAndroid
All versions
HuaweiBerkeley-L09 Firmware
before 10.0.0.177\(c10e3r1p4\)
HuaweiColumbia-Al10b Firmware
before 10.0.0.178\(c00e178r1p4\)
HuaweiColumbia-L29d Firmware
before 10.0.0.177\(c10e4r1p4\)
before 10.0.0.177\(c432e3r1p4\)
HuaweiColumbia-Tl00b Firmware
before 10.0.0.178\(c01e178r1p4\)
HuaweiColumbia-Tl00d Firmware
before 10.0.0.178\(c01e178r1p4\)
HuaweiCornell-Al00a Firmware
before 9.1.0.340\(c00e333r1p1t8\)
HuaweiCornell-Tl10b Firmware
before 9.1.0.340\(c01e333r1p1t8\)
HuaweiDura-Al00a Firmware
before 1.0.0.190\(c00\)
HuaweiHonor 20 Pro Firmware
before 10.0.0.194\(c636e3r3p1\)
before 10.0.0.202\(c10e3r3p2\)
HuaweiY6 2019 Firmware
before 9.1.0.290\(c185e5r4p1\)
before 9.1.0.290\(c431e1r1p8\)
before 9.1.0.290\(c605e6r1p6\)
before 9.1.0.295\(c431e5r2p2\)
HuaweiNova 3 Firmware
before 9.1.0.338\(c00e333r1p1t8\)

Weakness classification

CWE-787

References