CVE-2020-0069 PoC — Google Android Mediatek Command Queue driver 缓冲区错误漏洞

Source

Associated Vulnerability

Title:Google Android Mediatek Command Queue driver 缓冲区错误漏洞 (CVE-2020-0069)
Description:In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Description

CVE-2020-0069

Readme

# MTK SU

MTK SU is a LPE for CVE-2020-0069. This exploit was tested on a TCL LX A502DL
with a MediaTek MT6739 SoC running Android 8.1.0.

## Build

```
mkdir build
cd build
export ANDROID_NDK=<path_to_android_ndk>
cmake -DCMAKE_TOOLCHAIN_FILE="${ANDROID_NDK?}/build/cmake/android.toolchain.cmake" -DANDROID_ABI="armeabi-v7a" -DANDROID_PLATFORM=android-21 ../
cmake --build .
```

File Snapshot


 [4.0K]  /data/pocs/0a86cc4c170f16cf4707eca154ebf70d96510c50
├── [ 430]  CMakeLists.txt
├── [4.0K]  include
│   ├── [ 763]  disasm.hpp
│   ├── [ 571]  kallsyms.hpp
│   ├── [ 682]  log.hpp
│   ├── [2.2K]  mtk.hpp
│   ├── [1.0K]  mtk_su.hpp
│   ├── [ 544]  selinux.hpp
│   ├── [ 447]  task.hpp
│   └── [1.5K]  utils.hpp
├── [ 34K]  LICENSE
├── [ 380]  README.md
└── [4.0K]  src
    ├── [2.4K]  disasm.cpp
    ├── [ 19K]  kallsyms.cpp
    ├── [ 620]  log.cpp
    ├── [1.3K]  main.cpp
    ├── [ 15K]  mtk_su.cpp
    ├── [3.2K]  selinux.cpp
    ├── [ 18K]  task.cpp
    └── [ 942]  utils.cpp

2 directories, 19 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!