CVE-2020-0069: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Other sources
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Implement SELinux (SEAndroid) policy rules to restrict which processes can invoke the MediaTek Command Queue driver's ioctl handlers. Specifically, create/modify SELinux rules to limit access to the driver/device nodes for the Mediatek Command Queue driver so only trusted system components can call its ioctls, mitigating the out-of-bounds write and local privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-0069?
The severity of CVE-2020-0069 is classified as critical due to the potential for local escalation of privilege.
How do I fix CVE-2020-0069?
To fix CVE-2020-0069, update the affected Mediatek Command Queue driver to the latest version that includes proper input sanitization and SELinux restrictions.
Who is affected by CVE-2020-0069?
CVE-2020-0069 affects devices running specific versions of Google Android and Mediatek multiple chipsets.
What types of devices are vulnerable to CVE-2020-0069?
Vulnerable devices include a variety of Huawei smartphones utilizing specific chipsets and firmware versions.
Is user interaction required to exploit CVE-2020-0069?
No, user interaction is not required to exploit CVE-2020-0069 as it allows for local privilege escalation.