CVE-2020-0069: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-10 · updated 2026-06-17
Weakness: CWE-787

Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Affected products

Android: all versions
Huawei Berkeley-L09 Firmware: before 10.0.0.177\(c10e3r1p4\) — fixed in 10.0.0.177\(c10e3r1p4\)
Huawei Columbia-Al10B Firmware: before 10.0.0.178\(c00e178r1p4\) — fixed in 10.0.0.178\(c00e178r1p4\)
Huawei Columbia-L29D Firmware: before 10.0.0.177\(c10e4r1p4\); before 10.0.0.177\(c432e3r1p4\) — fixed in 10.0.0.177\(c10e4r1p4\), 10.0.0.177\(c432e3r1p4\)
Huawei Columbia-Tl00B Firmware: before 10.0.0.178\(c01e178r1p4\) — fixed in 10.0.0.178\(c01e178r1p4\)
Huawei Columbia-Tl00D Firmware: before 10.0.0.178\(c01e178r1p4\) — fixed in 10.0.0.178\(c01e178r1p4\)
Huawei Cornell-Al00A Firmware: before 9.1.0.340\(c00e333r1p1t8\) — fixed in 9.1.0.340\(c00e333r1p1t8\)
Huawei Cornell-Tl10B Firmware: before 9.1.0.340\(c01e333r1p1t8\) — fixed in 9.1.0.340\(c01e333r1p1t8\)
Huawei Dura-Al00A Firmware: before 1.0.0.190\(c00\) — fixed in 1.0.0.190\(c00\)
Huawei Honor 20 Pro Firmware: before 10.0.0.194\(c636e3r3p1\); before 10.0.0.202\(c10e3r3p2\) — fixed in 10.0.0.194\(c636e3r3p1\), 10.0.0.202\(c10e3r3p2\)
Huawei Honor 8A Firmware: before 9.1.0.291\(c185e3r4p1\); before 9.1.0.291\(c432e5r2p1\); before 9.1.0.291\(c636e4r4p1\); before 9.1.0.297\(c605e4r4p2\) — fixed in 9.1.0.291\(c185e3r4p1\), 9.1.0.291\(c432e5r2p1\), 9.1.0.291\(c636e4r4p1\), 9.1.0.297\(c605e4r4p2\)
Huawei Honor View 20 Firmware: before 10.0.0.198\(c432e10r3p4\); before 10.0.0.200\(c185e3r3p3\); before 10.0.0.201\(c10e5r4p3\) — fixed in 10.0.0.198\(c432e10r3p4\), 10.0.0.200\(c185e3r3p3\), 10.0.0.201\(c10e5r4p3\)
Huawei Jakarta-Al00A Firmware: before 9.1.0.251\(c00e106r2p2\) — fixed in 9.1.0.251\(c00e106r2p2\)
Huawei Katyusha-Al00A Firmware: before 9.1.0.146\(c00e131r2p2\) — fixed in 9.1.0.146\(c00e131r2p2\)
Huawei Katyusha-Al10A Firmware: before 9.1.0.160\(c00e150r1p7\) — fixed in 9.1.0.160\(c00e150r1p7\)
Huawei Madrid-Al00A Firmware: before 9.1.0.261\(c00e120r4p1\) — fixed in 9.1.0.261\(c00e120r4p1\)
Huawei Nova 3 Firmware: before 9.1.0.338\(c00e333r1p1t8\) — fixed in 9.1.0.338\(c00e333r1p1t8\)
Huawei Nova 4 Firmware: before 10.0.0.160\(c01e32r2p4\) — fixed in 10.0.0.160\(c01e32r2p4\)
Huawei Paris-L29B Firmware: before 9.1.0.380\(c636e1r1p3t8\) — fixed in 9.1.0.380\(c636e1r1p3t8\)
Huawei Princeton-Al10B Firmware: before 10.0.0.194\(c00e61r4p11\) — fixed in 10.0.0.194\(c00e61r4p11\)
Huawei Sydney-Al00 Firmware: before 9.1.0.237\(c00e80r1p7t8\) — fixed in 9.1.0.237\(c00e80r1p7t8\)
Huawei Sydney-Tl00 Firmware: before 9.1.0.237\(c01e80r1p7t8\) — fixed in 9.1.0.237\(c01e80r1p7t8\)
Huawei Sydneym-Al00 Firmware: before 10.0.0.159\(c00e64r1p5\) — fixed in 10.0.0.159\(c00e64r1p5\)
Huawei Tony-Al00B Firmware: before 10.1.0.137\(c00e137r2p11\) — fixed in 10.1.0.137\(c00e137r2p11\)
Huawei Tony-Tl00B Firmware: before 10.0.0.196\(c01e65r2p11\) — fixed in 10.0.0.196\(c01e65r2p11\)
Huawei Y6 2019 Firmware: before 9.1.0.290\(c185e5r4p1\); before 9.1.0.290\(c431e1r1p8\); before 9.1.0.290\(c605e6r1p6\); before 9.1.0.295\(c431e5r2p2\) — fixed in 9.1.0.290\(c185e5r4p1\), 9.1.0.290\(c431e1r1p8\), 9.1.0.290\(c605e6r1p6\), 9.1.0.295\(c431e5r2p2\)
Huawei Yale-Al00A Firmware: before 10.0.0.196\(c00e62r8p12\) — fixed in 10.0.0.196\(c00e62r8p12\)
Huawei Yale-L21A Firmware: before 10.0.0.202\(c10e3r3p2\) — fixed in 10.0.0.202\(c10e3r3p2\)
Huawei Yalep-Al10B Firmware: before 10.0.0.194\(c00e62r8p12\) — fixed in 10.0.0.194\(c00e62r8p12\)

How to fix

Upgrade to a fixed version: Huawei Berkeley-L09 Firmware 10.0.0.177\(c10e3r1p4\); Huawei Columbia-Al10B Firmware 10.0.0.178\(c00e178r1p4\); Huawei Columbia-L29D Firmware 10.0.0.177\(c10e4r1p4\), 10.0.0.177\(c432e3r1p4\); Huawei Columbia-Tl00B Firmware 10.0.0.178\(c01e178r1p4\); Huawei Columbia-Tl00D Firmware 10.0.0.178\(c01e178r1p4\); Huawei Cornell-Al00A Firmware 9.1.0.340\(c00e333r1p1t8\); Huawei Cornell-Tl10B Firmware 9.1.0.340\(c01e333r1p1t8\); Huawei Dura-Al00A Firmware 1.0.0.190\(c00\); Huawei Honor 20 Pro Firmware 10.0.0.194\(c636e3r3p1\), 10.0.0.202\(c10e3r3p2\); Huawei Honor 8A Firmware 9.1.0.291\(c185e3r4p1\), 9.1.0.291\(c432e5r2p1\), 9.1.0.291\(c636e4r4p1\), 9.1.0.297\(c605e4r4p2\); Huawei Honor View 20 Firmware 10.0.0.198\(c432e10r3p4\), 10.0.0.200\(c185e3r3p3\), 10.0.0.201\(c10e5r4p3\); Huawei Jakarta-Al00A Firmware 9.1.0.251\(c00e106r2p2\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-0069 or the next vulnerability affects your stack