CVE DatabaseCVE-2020-0069

Updated 2026-06-17한국어 권고문 →

CVE-2020-00697.8/HIGHCISA KEVCWE-787CWE-787

MediaTek Command Queue Driver Out-of-Bounds Write Local Privilege Escalation (CVE-2020-0069)

⚡ Jump to Patch

Affected Vendors

mediatek, google

Affected Components

android, mediatek_command_queue_driver

Published Date

2020-03-10

CVSS v3.1

7.8

HIGH

EPSS (30d)

1.4%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Android mobile devices powered by MediaTek chipsets running vulnerable kernel versions prior to the March 2020 patch level

Impact

A local attacker can exploit this vulnerability to gain root privileges and achieve full system compromise without any user interaction

Mitigation

Apply the March 2020 (or later) Android security patch, or restrict access permissions to the vulnerable '/dev/mtk_cmdq' device node

Affected Products & Version Scope

All Android devices powered by MediaTek chipsets with a security patch level prior to 2020-03-05

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is to apply the official system update provided by the device OEM. Ensure the Android Security Patch Level is '2020-03-05' or later.

For developers and system integrators, apply the kernel patch and rebuild the boot image as follows:

bash

# Navigate to the Android kernel source directory
cd /path/to/android/kernel/drivers/misc/mediatek/cmdq

# Verify if the CVE-2020-0069 patch is applied
git log --grep='CVE-2020-0069' --oneline

# Pull the security-patched branch and rebuild
git pull origin android-security-10.0.0_r33
make bootimage -j$(nproc)

2. Temporary Workaround & Hardening Configuration

If an official patch is unavailable for legacy devices, restrict access to the vulnerable device node using root privileges to mitigate the risk:

bash

# Revoke all permissions from the vulnerable device node
adb shell 'su -c "chmod 000 /dev/mtk_cmdq"'
adb shell 'su -c "chown root:root /dev/mtk_cmdq"'

3. Log Audit & IoC Verification Commands

Use the following shell script to verify if the vulnerable device node exists and is accessible by unprivileged users:

bash

#!/system/bin/sh
# Script to check for the presence and permissions of the CMDQ device node

TARGET_DEV='/dev/mtk_cmdq'
if [ -e "$TARGET_DEV" ]; then
    echo '[!] Warning: MediaTek CMDQ device node found.'
    ls -l "$TARGET_DEV"
    
    # Check if the node has insecure permissions
    PERM=$(stat -c '%a' "$TARGET_DEV")
    if [ "$PERM" -ne 000 ]; then
        echo '[CRITICAL] Device node is accessible! Vulnerable to CVE-2020-0069.'
    else
        echo '[INFO] Device node is hardened (permissions set to 000).'
    fi
else
    echo '[OK] MediaTek CMDQ device node not found on this system.'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Immediately update MediaTek-based Android devices to security patch level 2020-03-05 or later, or restrict permissions on the /dev/mtk_cmdq node.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-0069) is an out-of-bounds write (CWE-787) issue residing in the ioctl handlers of the MediaTek Command Queue (CMDQ) driver. The root cause is insufficient input sanitization of user-supplied parameters passed to the driver, combined with a lack of appropriate SELinux restrictions. This allows unprivileged local processes to write arbitrary data directly into kernel memory space.

2. Exploitation Mechanics & Attack Scenario

An attacker can execute a malicious application with standard user privileges to open the /dev/mtk_cmdq device node. By invoking specific ioctl commands with crafted memory addresses and size parameters, the attacker triggers the out-of-bounds write vulnerability within the kernel context. This allows the attacker to overwrite critical kernel data structures, such as the process's cred structure, effectively escalating their privileges to root. This vulnerability requires no user interaction and has been actively exploited in the wild (CISA KEV).

3. Infrastructure & Business Impact

Successful exploitation of this vulnerability compromises the entire security model of the affected Android device. Attackers can bypass application sandboxing, access sensitive corporate data (such as emails, credentials, and financial information), and disable Mobile Device Management (MDM) agents. In an enterprise environment, compromised devices can serve as a persistent foothold for lateral movement within the corporate network.

Official Vendor Advisories & References

NVD Original English Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en

Source: security@android.com · Vendor Advisory

https://source.android.com/security/bulletin/2020-03-01

Source: security@android.com · Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://source.android.com/security/bulletin/2020-03-01

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory, US Government Resource

Frequently Asked SecOps Questions (CVE-2020-0069)

FAQ

Q1. How critical is CVE-2020-0069 and is it actively exploited in the wild?

CVE-2020-0069 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 1.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-0069?

Primary impacted vendors include mediatek, google across android, mediatek_command_queue_driver. Scope summary: All Android devices powered by MediaTek chipsets with a security patch level prior to 2020-03-05

Q3. What temporary mitigations or workarounds exist for CVE-2020-0069 before patching?

[Mitigation] Apply the March 2020 (or later) Android security patch, or restrict access permissions to the vulnerable '/dev/mtk_cmdq' device node Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION