{"id":"CVE-2020-0069","kind":"vulnerability","aliases":["CVE-2020-0069"],"related":[],"title":"MediaTek Multiple Chipsets: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability","description":"In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754","summary":"A flaw in MediaTek chipset Command Queue driver ioctl handlers lets a process write out of bounds because input is not validated and SELinux does not restrict access. An attacker who already runs code on the device can escalate to higher privileges, and it was used in the wild chained with other bugs.","severity":"high","cvss":7.8,"epss":0.0137,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"MediaTek Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mediatek","mobile-devices"],"not_affected_if":["non-mediatek-chipset","patched-firmware"],"how_to_check":null,"fix":"Apply the MediaTek chipset security update for the device, per vendor instructions as CISA directs. Exact patched versions: unknown.","status":"open","published_at":"2020-03-10T20:15:21+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:06+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:32:06Z","model":"claude-haiku-5-5","output":{"fix":"Apply the MediaTek chipset security update for the device, per vendor instructions as CISA directs. Exact patched versions: unknown.","reach":"local","impact":"high","summary":"A flaw in MediaTek chipset Command Queue driver ioctl handlers lets a process write out of bounds because input is not validated and SELinux does not restrict access. An attacker who already runs code on the device can escalate to higher privileges, and it was used in the wild chained with other bugs.","category":"infrastructure","who_cares":["android","mediatek","mobile-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"local app gains kernel-level privileges on the device","analyst_note":"Find the affected MediaTek chipset list and patched Android security bulletin level, e.g. from the Android security bulletin for 2020 and the MediaTek advisory, plus a device check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-mediatek-chipset","patched-firmware"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2926,"output_tokens":389,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected MediaTek chipset list and patched Android security bulletin level, e.g. from the Android security bulletin for 2020 and the MediaTek advisory, plus a device check command.","search":"'-0069':13A,16A '-2020':12A,15A '147882143references':134C 'a-147882143references':132C 'access':54B 'addit':117C 'alps04356754':137C 'alreadi':58B 'android':20B,129C 'androidvers':128C 'attack':56B 'bound':43B,96C 'bug':79B 'chain':76B 'chipset':3A,6A,31B 'chipsets':19A 'code':60B 'command':32B,87C 'could':108C 'cve':11A,14A 'devic':26B,63B 'driver':34B,89C 'due':98C 'escal':65B,112C 'execut':118C 'exploit':21B 'exploitation.product':127C 'flaw':28B 'handler':36B,83C 'higher':67B 'id':131C 'infrastructur':22B 'input':8A,45B,101C 'insuffici':7A,100C 'interact':122C 'ioctl':35B,82C 'kernelandroid':130C 'lead':109C 'let':37B 'local':111C 'm':136C 'm-alps04356754':135C 'mediatek':1A,4A,17A,23B,30B,86C 'miss':104C 'mobil':25B 'mobile-devic':24B 'multipl':2A,5A 'multiple':18A 'need':120C,125C 'possibl':93C 'privileg':68B,114C,119C 'process':39B 'queue':33B,88C 'restrict':53B,106C 'run':59B 'sanit':102C 'selinux':50B,105C 'use':72B 'user':121C 'valid':9A,48B 'vulner':10A 'wild':75B 'write':40B,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-10T20:15:21+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-0069","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0069","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2020-0069","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0069","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-0069","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0069","severity":null,"published_at":"2020-03-10T20:15:21+00:00","modified_at":"2026-06-17T02:45:11+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}