CVE-2020-0069

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	Android	Android kernel

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-enVendor Advisory
https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-enVendor Advisory
https://source.android.com/security/bulletin/2020-03-01Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069Third Party Advisory, US Government Resource

Timeline

Published: Mar 10, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-00709.8In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead t CVE-2020-00719.8In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could le CVE-2020-00729.8In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2020-00739.8In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2020-00747.8In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default hand CVE-2020-00754.4In set_shared_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to lo CVE-2020-00766.7In get_auth_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2020-00774.4In authorize_enroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to CVE-2020-00787.8In releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local esca CVE-2020-00797.8In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. This could lead to local escalation of pri CVE-2020-00807.8In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps witho CVE-2020-00817.8In finalize of AssetManager.java, there is possible memory corruption due to a double free. This could lead to local escalation of privilege