CVE-2020-0069
HIGH KEVMediatek Command Queue driver - Privilege Escalation
Title source: llmExploitation Summary
CVE-2020-0069 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 4 public exploits from researchers including R0rt1z2, quarkslab, TheRealJunior.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-0069, targeting MediaTek devices to achieve root access via the `mtk-su` exploit. It includes scripts for both system-mode (SuperSU) and bootless-mode (Magisk) rooting, as well as unrooting capabilities.
Description
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
Exploits (4)
This repository contains a functional exploit for CVE-2020-0069, targeting MediaTek devices to achieve root access via the `mtk-su` exploit. It includes scripts for both system-mode (SuperSU) and bootless-mode (Magisk) rooting, as well as unrooting capabilities.
This repository contains a proof-of-concept exploit for CVE-2020-0069, targeting a Mediatek SoC (MT6762M) on a Xiaomi Redmi 6a. The exploit demonstrates arbitrary kernel memory read/write capabilities via the CMDQ driver, allowing modification of kernel data (e.g., changing the OS name string).
This repository contains a proof-of-concept exploit for CVE-2020-0069, targeting a vulnerability in MediaTek's Command Queue (CMDQ) driver. The exploit includes kernel module source code and scripts to analyze and interact with the vulnerable driver.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2020-0069, targeting MediaTek MT6739 SoCs running Android 8.1.0. The exploit leverages kernel memory manipulation to achieve root access, with components for disassembly, symbol resolution, and SELinux bypass.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H