Read the docs
TI-2020-00067 Aliases CVE-2020-0069GHSA-xx48-fp29-wh9j

Out-of-bounds write in Android

Priority CRITICAL 93Exploited in the wildCWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.01382 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—AndroidAndroid kernel—No fix listedCNA
  • Android Vendor— Affected Android kernel Fixed in — No fix listed CNA

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*not specified by NVDVulnerableGoogle
cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:*before 10.0.0.177\(c10e3r1p4\)VulnerableHuawei
cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:columbia-al10b_firmware:*:*:*:*:*:*:*:*before 10.0.0.178\(c00e178r1p4\)VulnerableHuawei
cpe:2.3:h:huawei:columbia-al10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:*before 10.0.0.177\(c10e4r1p4\)VulnerableHuawei
cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:*before 10.0.0.178\(c01e178r1p4\)VulnerableHuawei
cpe:2.3:h:huawei:columbia-tl00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:columbia-tl00d_firmware:*:*:*:*:*:*:*:*before 10.0.0.178\(c01e178r1p4\)VulnerableHuawei
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Google
  • cpe:2.3:o:huawei:berkeley-l09_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.177\(c10e3r1p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:berkeley-l09:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:columbia-al10b_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.178\(c00e178r1p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:columbia-al10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.177\(c10e4r1p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:columbia-l29d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:columbia-tl00b_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.178\(c01e178r1p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:columbia-tl00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:columbia-tl00d_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.178\(c01e178r1p4\) Vulnerable ·Huawei
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:huawei:columbia-tl00d:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:cornell-al00a_firmware:*:*:*:*:*:*:*:*before 9.1.0.340\(c00e333r1p1t8\)VulnerableHuawei
cpe:2.3:h:huawei:cornell-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:*before 9.1.0.340\(c01e333r1p1t8\)VulnerableHuawei
cpe:2.3:h:huawei:cornell-tl10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:*before 1.0.0.190\(c00\)VulnerableHuawei
cpe:2.3:h:huawei:dura-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*before 10.0.0.194\(c636e3r3p1\)VulnerableHuawei
cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:*before 9.1.0.290\(c185e5r4p1\)VulnerableHuawei
cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:*before 9.1.0.338\(c00e333r1p1t8\)VulnerableHuawei
cpe:2.3:h:huawei:nova_3:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:nova_4_firmware:*:*:*:*:*:*:*:*before 10.0.0.160\(c01e32r2p4\)VulnerableHuawei
cpe:2.3:h:huawei:nova_4:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:*before 9.1.0.291\(c185e3r4p1\)VulnerableHuawei
cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.0.0.198\(c432e10r3p4\)VulnerableHuawei
cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:*before 9.1.0.251\(c00e106r2p2\)VulnerableHuawei
cpe:2.3:h:huawei:jakarta-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:katyusha-al00a_firmware:*:*:*:*:*:*:*:*before 9.1.0.146\(c00e131r2p2\)VulnerableHuawei
cpe:2.3:h:huawei:katyusha-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:katyusha-al10a_firmware:*:*:*:*:*:*:*:*before 9.1.0.160\(c00e150r1p7\)VulnerableHuawei
cpe:2.3:h:huawei:katyusha-al10a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:madrid-al00a_firmware:*:*:*:*:*:*:*:*before 9.1.0.261\(c00e120r4p1\)VulnerableHuawei
cpe:2.3:h:huawei:madrid-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:paris-l29b_firmware:*:*:*:*:*:*:*:*before 9.1.0.380\(c636e1r1p3t8\)VulnerableHuawei
cpe:2.3:h:huawei:paris-l29b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:*before 10.0.0.194\(c00e61r4p11\)VulnerableHuawei
cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:*before 9.1.0.237\(c00e80r1p7t8\)VulnerableHuawei
cpe:2.3:h:huawei:sydney-al00:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:*before 9.1.0.237\(c01e80r1p7t8\)VulnerableHuawei
cpe:2.3:h:huawei:sydney-tl00:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:*before 10.0.0.159\(c00e64r1p5\)VulnerableHuawei
cpe:2.3:h:huawei:sydneym-al00:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:*before 10.1.0.137\(c00e137r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:*before 10.0.0.196\(c01e65r2p11\)VulnerableHuawei
cpe:2.3:h:huawei:tony-tl00b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:*before 10.0.0.196\(c00e62r8p12\)VulnerableHuawei
cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:*before 10.0.0.202\(c10e3r3p2\)VulnerableHuawei
cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:*before 10.0.0.194\(c00e62r8p12\)VulnerableHuawei
cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:*before 10.0.0.177\(c432e3r1p4\)VulnerableHuawei
cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:*before 10.0.0.202\(c10e3r3p2\)VulnerableHuawei
cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:*before 9.1.0.290\(c431e1r1p8\); before 9.1.0.290\(c605e6r1p6\); before 9.1.0.295\(c431e5r2p2\)VulnerableHuawei
cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:*before 9.1.0.291\(c432e5r2p1\); before 9.1.0.291\(c636e4r4p1\); before 9.1.0.297\(c605e4r4p2\)VulnerableHuawei
cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*before 10.0.0.200\(c185e3r3p3\); before 10.0.0.201\(c10e5r4p3\)VulnerableHuawei
  • cpe:2.3:h:huawei:columbia-tl00d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:cornell-al00a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.340\(c00e333r1p1t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:cornell-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:cornell-tl10b_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.340\(c01e333r1p1t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:cornell-tl10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:dura-al00a_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.190\(c00\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:dura-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.194\(c636e3r3p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_20_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.290\(c185e5r4p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:y6_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.338\(c00e333r1p1t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:nova_3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:nova_4_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.160\(c01e32r2p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:nova_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.291\(c185e3r4p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_8a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.198\(c432e10r3p4\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:honor_view_20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:jakarta-al00a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.251\(c00e106r2p2\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:jakarta-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:katyusha-al00a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.146\(c00e131r2p2\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:katyusha-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:katyusha-al10a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.160\(c00e150r1p7\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:katyusha-al10a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:madrid-al00a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.261\(c00e120r4p1\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:madrid-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:paris-l29b_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.380\(c636e1r1p3t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:paris-l29b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:princeton-al10b_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.194\(c00e61r4p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:princeton-al10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:sydney-al00_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.237\(c00e80r1p7t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:sydney-al00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:sydney-tl00_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.237\(c01e80r1p7t8\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:sydney-tl00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:sydneym-al00_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.159\(c00e64r1p5\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:sydneym-al00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:tony-al00b_firmware:*:*:*:*:*:*:*:* Versions before 10.1.0.137\(c00e137r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:tony-al00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:tony-tl00b_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.196\(c01e65r2p11\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:tony-tl00b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-al00a_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.196\(c00e62r8p12\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yale-l21a_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.202\(c10e3r3p2\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yale-l21a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:yalep-al10b_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.194\(c00e62r8p12\) Vulnerable ·Huawei
  • cpe:2.3:h:huawei:yalep-al10b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
  • cpe:2.3:o:huawei:columbia-l29d_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.177\(c432e3r1p4\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:honor_20_pro_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.202\(c10e3r3p2\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:y6_2019_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.290\(c431e1r1p8\); before 9.1.0.290\(c605e6r1p6\); before 9.1.0.295\(c431e5r2p2\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:* Versions before 9.1.0.291\(c432e5r2p1\); before 9.1.0.291\(c636e4r4p1\); before 9.1.0.297\(c605e4r4p2\) Vulnerable ·Huawei
  • cpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:* Versions before 10.0.0.200\(c185e3r3p3\); before 10.0.0.201\(c10e5r4p3\) Vulnerable ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2020-0069
  3. 2026-10-03 Alias added: GHSA-xx48-fp29-wh9j

References

Advisory 3

  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2025-14725 Integer overflow in MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6886… CVSS 3.1MEDIUM 6.5
  • TI-2024-13114 Memory corruption in MediaTek MT2735, MT2737, MT6833, MT6835, MT6835T, MT6853, MT6855… CVSS 3.1CRITICAL 9.8
  • TI-2022-14283 Command injection in MediaTek EN7528, EN7580 CVSS 3.1CRITICAL 9.8
  • TI-2021-11684 Command injection in MediaTek EN7528, EN7580 CVSS 3.1CRITICAL 9.8
  • TI-2021-11683 Command injection in MediaTek EN7528, EN7580 CVSS 3.1CRITICAL 9.8
See all 1133 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences