CVE-2020-0069: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 1.4% chance of exploitation in the next 30 days.

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Affected products

Google Android: affected versions not specified
Huawei Berkeley-l09 Firmware: before 10.0.0.177\(c10e3r1p4\) (fixed in 10.0.0.177\(c10e3r1p4\))
Huawei Columbia-AL10B Firmware: before 10.0.0.178\(c00e178r1p4\) (fixed in 10.0.0.178\(c00e178r1p4\))
Huawei Columbia-l29d Firmware: before 10.0.0.177\(c10e4r1p4\) (fixed in 10.0.0.177\(c10e4r1p4\)); before 10.0.0.177\(c432e3r1p4\) (fixed in 10.0.0.177\(c432e3r1p4\))
Huawei Columbia-TL00B Firmware: before 10.0.0.178\(c01e178r1p4\) (fixed in 10.0.0.178\(c01e178r1p4\))
Huawei Columbia-TL00D Firmware: before 10.0.0.178\(c01e178r1p4\) (fixed in 10.0.0.178\(c01e178r1p4\))
Huawei Cornell-AL00A Firmware: before 9.1.0.340\(c00e333r1p1t8\) (fixed in 9.1.0.340\(c00e333r1p1t8\))
Huawei Cornell-TL10B Firmware: before 9.1.0.340\(c01e333r1p1t8\) (fixed in 9.1.0.340\(c01e333r1p1t8\))
Huawei Dura-AL00A Firmware: before 1.0.0.190\(c00\) (fixed in 1.0.0.190\(c00\))
Huawei Honor 20 Pro Firmware: before 10.0.0.194\(c636e3r3p1\) (fixed in 10.0.0.194\(c636e3r3p1\)); before 10.0.0.202\(c10e3r3p2\) (fixed in 10.0.0.202\(c10e3r3p2\))
Huawei Honor 8a Firmware: before 9.1.0.291\(c185e3r4p1\) (fixed in 9.1.0.291\(c185e3r4p1\)); before 9.1.0.291\(c432e5r2p1\) (fixed in 9.1.0.291\(c432e5r2p1\)); before 9.1.0.291\(c636e4r4p1\) (fixed in 9.1.0.291\(c636e4r4p1\)); before 9.1.0.297\(c605e4r4p2\) (fixed in 9.1.0.297\(c605e4r4p2\))
Huawei Honor View 20 Firmware: before 10.0.0.198\(c432e10r3p4\) (fixed in 10.0.0.198\(c432e10r3p4\)); before 10.0.0.200\(c185e3r3p3\) (fixed in 10.0.0.200\(c185e3r3p3\)); before 10.0.0.201\(c10e5r4p3\) (fixed in 10.0.0.201\(c10e5r4p3\))
Huawei Jakarta-AL00A Firmware: before 9.1.0.251\(c00e106r2p2\) (fixed in 9.1.0.251\(c00e106r2p2\))
Huawei Katyusha-AL00A Firmware: before 9.1.0.146\(c00e131r2p2\) (fixed in 9.1.0.146\(c00e131r2p2\))
Huawei Katyusha-AL10A Firmware: before 9.1.0.160\(c00e150r1p7\) (fixed in 9.1.0.160\(c00e150r1p7\))
Huawei Madrid-AL00A Firmware: before 9.1.0.261\(c00e120r4p1\) (fixed in 9.1.0.261\(c00e120r4p1\))
Huawei Nova 3 Firmware: before 9.1.0.338\(c00e333r1p1t8\) (fixed in 9.1.0.338\(c00e333r1p1t8\))
Huawei Nova 4 Firmware: before 10.0.0.160\(c01e32r2p4\) (fixed in 10.0.0.160\(c01e32r2p4\))
Huawei Paris-l29b Firmware: before 9.1.0.380\(c636e1r1p3t8\) (fixed in 9.1.0.380\(c636e1r1p3t8\))
Huawei Princeton-AL10B Firmware: before 10.0.0.194\(c00e61r4p11\) (fixed in 10.0.0.194\(c00e61r4p11\))
Huawei Sydney-AL00 Firmware: before 9.1.0.237\(c00e80r1p7t8\) (fixed in 9.1.0.237\(c00e80r1p7t8\))
Huawei Sydney-TL00 Firmware: before 9.1.0.237\(c01e80r1p7t8\) (fixed in 9.1.0.237\(c01e80r1p7t8\))
Huawei Sydneym-AL00 Firmware: before 10.0.0.159\(c00e64r1p5\) (fixed in 10.0.0.159\(c00e64r1p5\))
Huawei Tony-AL00B Firmware: before 10.1.0.137\(c00e137r2p11\) (fixed in 10.1.0.137\(c00e137r2p11\))
Huawei Tony-TL00B Firmware: before 10.0.0.196\(c01e65r2p11\) (fixed in 10.0.0.196\(c01e65r2p11\))
and 4 more

Published 2020-03-10. Last modified 2026-06-17.