IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High KEV

CVE-2020-0069Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Android Published: (6 years ago)

Known exploited — Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-0069

Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Weakness (CWE): CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
google android —
huawei berkeley-l09 firmware < 10.0.0.177\(c10e3r1p4\)
huawei columbia-al10b firmware < 10.0.0.178\(c00e178r1p4\)
huawei columbia-l29d firmware < 10.0.0.177\(c10e4r1p4\)
huawei columbia-tl00b firmware < 10.0.0.178\(c01e178r1p4\)
huawei columbia-tl00d firmware < 10.0.0.178\(c01e178r1p4\)
huawei cornell-al00a firmware < 9.1.0.340\(c00e333r1p1t8\)
huawei cornell-tl10b firmware < 9.1.0.340\(c01e333r1p1t8\)
huawei dura-al00a firmware < 1.0.0.190\(c00\)
huawei honor 20 pro firmware < 10.0.0.194\(c636e3r3p1\)
huawei honor 8a firmware < 9.1.0.291\(c185e3r4p1\)
huawei honor view 20 firmware < 10.0.0.198\(c432e10r3p4\)
huawei jakarta-al00a firmware < 9.1.0.251\(c00e106r2p2\)
huawei katyusha-al00a firmware < 9.1.0.146\(c00e131r2p2\)
huawei katyusha-al10a firmware < 9.1.0.160\(c00e150r1p7\)
huawei madrid-al00a firmware < 9.1.0.261\(c00e120r4p1\)
huawei nova 3 firmware < 9.1.0.338\(c00e333r1p1t8\)
huawei nova 4 firmware < 10.0.0.160\(c01e32r2p4\)
huawei paris-l29b firmware < 9.1.0.380\(c636e1r1p3t8\)
huawei princeton-al10b firmware < 10.0.0.194\(c00e61r4p11\)
huawei sydney-al00 firmware < 9.1.0.237\(c00e80r1p7t8\)
huawei sydney-tl00 firmware < 9.1.0.237\(c01e80r1p7t8\)
huawei sydneym-al00 firmware < 10.0.0.159\(c00e64r1p5\)
huawei tony-al00b firmware < 10.1.0.137\(c00e137r2p11\)
huawei tony-tl00b firmware < 10.0.0.196\(c01e65r2p11\)
huawei y6 2019 firmware < 9.1.0.290\(c185e5r4p1\)
huawei yale-al00a firmware < 10.0.0.196\(c00e62r8p12\)
huawei yale-l21a firmware < 10.0.0.202\(c10e3r3p2\)
huawei yalep-al10b firmware < 10.0.0.194\(c00e62r8p12\)
— Android Android kernel

References and patches

CPE matches (NVD) (39)
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
  • cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* < 10.0.0.177\(c10e3r1p4\)
  • cpe:2.3:o:huawei:columbia-al10b_firmware:*:*:*:*:*:*:*:* < 10.0.0.178\(c00e178r1p4\)
  • cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* < 10.0.0.177\(c10e4r1p4\)
  • cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.178\(c01e178r1p4\)
  • cpe:2.3:o:huawei:columbia-tl00d_firmware:*:*:*:*:*:*:*:* < 10.0.0.178\(c01e178r1p4\)
  • cpe:2.3:o:huawei:cornell-al00a_firmware:*:*:*:*:*:*:*:* < 9.1.0.340\(c00e333r1p1t8\)
  • cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:* < 9.1.0.340\(c01e333r1p1t8\)
  • cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:* < 1.0.0.190\(c00\)
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* < 10.0.0.194\(c636e3r3p1\)
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* < 9.1.0.290\(c185e5r4p1\)
  • cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:* < 9.1.0.338\(c00e333r1p1t8\)
  • cpe:2.3:o:huawei:nova_4_firmware:*:*:*:*:*:*:*:* < 10.0.0.160\(c01e32r2p4\)
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* < 9.1.0.291\(c185e3r4p1\)
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* < 10.0.0.198\(c432e10r3p4\)
  • cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:* < 9.1.0.251\(c00e106r2p2\)
  • cpe:2.3:o:huawei:katyusha-al00a_firmware:*:*:*:*:*:*:*:* < 9.1.0.146\(c00e131r2p2\)
  • cpe:2.3:o:huawei:katyusha-al10a_firmware:*:*:*:*:*:*:*:* < 9.1.0.160\(c00e150r1p7\)
  • cpe:2.3:o:huawei:madrid-al00a_firmware:*:*:*:*:*:*:*:* < 9.1.0.261\(c00e120r4p1\)
  • cpe:2.3:o:huawei:paris-l29b_firmware:*:*:*:*:*:*:*:* < 9.1.0.380\(c636e1r1p3t8\)
  • cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:* < 10.0.0.194\(c00e61r4p11\)
  • cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:* < 9.1.0.237\(c00e80r1p7t8\)
  • cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:* < 9.1.0.237\(c01e80r1p7t8\)
  • cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:* < 10.0.0.159\(c00e64r1p5\)
  • cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:* < 10.1.0.137\(c00e137r2p11\)
  • cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:* < 10.0.0.196\(c01e65r2p11\)
  • cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:* < 10.0.0.196\(c00e62r8p12\)
  • cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:* < 10.0.0.202\(c10e3r3p2\)
  • cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:* < 10.0.0.194\(c00e62r8p12\)
  • cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* < 10.0.0.177\(c432e3r1p4\)
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* < 10.0.0.202\(c10e3r3p2\)
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* < 9.1.0.290\(c431e1r1p8\)
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* < 9.1.0.290\(c605e6r1p6\)
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* < 9.1.0.295\(c431e5r2p2\)
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* < 9.1.0.291\(c432e5r2p1\)
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* < 9.1.0.291\(c636e4r4p1\)
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* < 9.1.0.297\(c605e4r4p2\)
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* < 10.0.0.200\(c185e3r3p3\)
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* < 10.0.0.201\(c10e5r4p3\)

Recent CVEs in the same product — Android

8.4High
CVE-2026-95405
Google Android

In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. Use…

6.7Medium
CVE-2026-95404
Google Android

In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interact…

8.4High
CVE-2026-95403
Google Android

In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…

7.8High
CVE-2026-95402
Google Android

In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

7.8High
CVE-2026-95401
Google Android

In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

8.4High
CVE-2026-95400
Google Android

In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…