{"cve_id":"CVE-2020-0069","published":"2020-03-10T20:15:21.947000+00:00","last_modified":"2026-06-17T02:45:11.200000+00:00","vuln_status":"Analyzed","description":"In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","base_score":7.8,"base_severity":"HIGH","attack_vector":"LOCAL","privileges_req":"LOW","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-787"],"in_kev":true,"kev_date_added":"2021-11-03","kev_ransomware":false,"epss_score":0.01382,"epss_percentile":0.72159,"cap_rule_version":"0.1.1","stage":"EXECUTION","req_access":"USER","req_vector":"LOCAL","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:13:41.777207+00:00","first_seen":"2020-03-10T20:15:21.947000+00:00","kev_first_seen":"2021-11-03T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["google","huawei"],"products":["android","berkeley-l09","berkeley-l09_firmware","columbia-al10b","columbia-al10b_firmware","columbia-l29d","columbia-l29d_firmware","columbia-tl00b","columbia-tl00b_firmware","columbia-tl00d","columbia-tl00d_firmware","cornell-al00a","cornell-al00a_firmware","cornell-tl10b","cornell-tl10b_firmware","dura-al00a","dura-al00a_firmware","honor_20_pro","honor_20_pro_firmware","honor_8a","honor_8a_firmware","honor_view_20","honor_view_20_firmware","jakarta-al00a","jakarta-al00a_firmware","katyusha-al00a","katyusha-al00a_firmware","katyusha-al10a","katyusha-al10a_firmware","madrid-al00a","madrid-al00a_firmware","nova_3","nova_3_firmware","nova_4","nova_4_firmware","paris-l29b","paris-l29b_firmware","princeton-al10b","princeton-al10b_firmware","sydney-al00","sydney-al00_firmware","sydney-tl00","sydney-tl00_firmware","sydneym-al00","sydneym-al00_firmware","tony-al00b","tony-al00b_firmware","tony-tl00b","tony-tl00b_firmware","y6_2019","y6_2019_firmware","yale-al00a","yale-al00a_firmware","yale-l21a","yale-l21a_firmware","yalep-al10b","yalep-al10b_firmware"],"affected":[{"vendor":"google","product":"android","ranges":["all versions"]},{"vendor":"huawei","product":"berkeley-l09_firmware","ranges":["< 10.0.0.177\\(c10e3r1p4\\)"]},{"vendor":"huawei","product":"columbia-al10b_firmware","ranges":["< 10.0.0.178\\(c00e178r1p4\\)"]},{"vendor":"huawei","product":"columbia-l29d_firmware","ranges":["< 10.0.0.177\\(c10e4r1p4\\)","< 10.0.0.177\\(c432e3r1p4\\)"]},{"vendor":"huawei","product":"columbia-tl00b_firmware","ranges":["< 10.0.0.178\\(c01e178r1p4\\)"]},{"vendor":"huawei","product":"columbia-tl00d_firmware","ranges":["< 10.0.0.178\\(c01e178r1p4\\)"]},{"vendor":"huawei","product":"cornell-al00a_firmware","ranges":["< 9.1.0.340\\(c00e333r1p1t8\\)"]},{"vendor":"huawei","product":"cornell-tl10b_firmware","ranges":["< 9.1.0.340\\(c01e333r1p1t8\\)"]},{"vendor":"huawei","product":"dura-al00a_firmware","ranges":["< 1.0.0.190\\(c00\\)"]},{"vendor":"huawei","product":"honor_20_pro_firmware","ranges":["< 10.0.0.202\\(c10e3r3p2\\)","< 10.0.0.194\\(c636e3r3p1\\)"]},{"vendor":"huawei","product":"honor_8a_firmware","ranges":["< 9.1.0.291\\(c432e5r2p1\\)","< 9.1.0.291\\(c636e4r4p1\\)","< 9.1.0.291\\(c185e3r4p1\\)","< 9.1.0.297\\(c605e4r4p2\\)"]},{"vendor":"huawei","product":"honor_view_20_firmware","ranges":["< 10.0.0.201\\(c10e5r4p3\\)","< 10.0.0.198\\(c432e10r3p4\\)","< 10.0.0.200\\(c185e3r3p3\\)"]},{"vendor":"huawei","product":"jakarta-al00a_firmware","ranges":["< 9.1.0.251\\(c00e106r2p2\\)"]},{"vendor":"huawei","product":"katyusha-al00a_firmware","ranges":["< 9.1.0.146\\(c00e131r2p2\\)"]},{"vendor":"huawei","product":"katyusha-al10a_firmware","ranges":["< 9.1.0.160\\(c00e150r1p7\\)"]},{"vendor":"huawei","product":"madrid-al00a_firmware","ranges":["< 9.1.0.261\\(c00e120r4p1\\)"]},{"vendor":"huawei","product":"nova_3_firmware","ranges":["< 9.1.0.338\\(c00e333r1p1t8\\)"]},{"vendor":"huawei","product":"nova_4_firmware","ranges":["< 10.0.0.160\\(c01e32r2p4\\)"]},{"vendor":"huawei","product":"paris-l29b_firmware","ranges":["< 9.1.0.380\\(c636e1r1p3t8\\)"]},{"vendor":"huawei","product":"princeton-al10b_firmware","ranges":["< 10.0.0.194\\(c00e61r4p11\\)"]},{"vendor":"huawei","product":"sydney-al00_firmware","ranges":["< 9.1.0.237\\(c00e80r1p7t8\\)"]},{"vendor":"huawei","product":"sydney-tl00_firmware","ranges":["< 9.1.0.237\\(c01e80r1p7t8\\)"]},{"vendor":"huawei","product":"sydneym-al00_firmware","ranges":["< 10.0.0.159\\(c00e64r1p5\\)"]},{"vendor":"huawei","product":"tony-al00b_firmware","ranges":["< 10.1.0.137\\(c00e137r2p11\\)"]},{"vendor":"huawei","product":"tony-tl00b_firmware","ranges":["< 10.0.0.196\\(c01e65r2p11\\)"]},{"vendor":"huawei","product":"y6_2019_firmware","ranges":["< 9.1.0.290\\(c605e6r1p6\\)","< 9.1.0.290\\(c431e1r1p8\\)","< 9.1.0.295\\(c431e5r2p2\\)","< 9.1.0.290\\(c185e5r4p1\\)"]},{"vendor":"huawei","product":"yale-al00a_firmware","ranges":["< 10.0.0.196\\(c00e62r8p12\\)"]},{"vendor":"huawei","product":"yale-l21a_firmware","ranges":["< 10.0.0.202\\(c10e3r3p2\\)"]},{"vendor":"huawei","product":"yalep-al10b_firmware","ranges":["< 10.0.0.194\\(c00e62r8p12\\)"]}]}