CVE-2020-0069 PoC — Google Android Mediatek Command Queue driver 缓冲区错误漏洞

Source

https://github.com/TheRealJunior/mtk-su-reverse-cve-2020-0069

Associated Vulnerability

Title:Google Android Mediatek Command Queue driver 缓冲区错误漏洞 (CVE-2020-0069)
Description:In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

Description

reversing mtk-su

Readme

# mtk-su

just some of my notes

## String table

get decompressed string table by using `binwalk -Xe string_table_dump`
dump from address in idb

0x1F098
compressed size: 1260


if you want the idb open an issue with your email and i'll send it. it's a good starting point if you want to re-write the exploit.

File Snapshot


 [4.0K]  /data/pocs/0fcb8c652a0a2e9875069b80a722e484d4ea1814
├── [4.0K]  data
│   ├── [1.2K]  string_table_dump
│   └── [3.4K]  string_table_dump_decompressed
├── [4.0K]  open-source
│   └── [4.0K]  android-mtk-3.18
│       ├── [234K]  cmdq_core.c
│       ├── [ 30K]  cmdq_core.h
│       ├── [ 12K]  cmdq_def.h
│       ├── [ 13K]  cmdq_device.c
│       ├── [2.6K]  cmdq_device.h
│       ├── [ 31K]  cmdq_driver.c
│       ├── [3.0K]  cmdq_driver.h
│       ├── [1.8K]  cmdq_engine_common.h
│       ├── [ 15K]  cmdq_event_common.h
│       ├── [ 739]  cmdq_instr_cycle.h
│       ├── [ 24K]  cmdq_mdp_common.c
│       ├── [4.0K]  cmdq_mdp_common.h
│       ├── [1.8K]  cmdq_mmp.c
│       ├── [ 593]  cmdq_mmp.h
│       ├── [3.4K]  cmdq_prof.c
│       ├── [ 197]  cmdq_prof.h
│       ├── [ 43K]  cmdq_record.c
│       ├── [ 15K]  cmdq_record.h
│       ├── [ 607]  cmdq_record_private.h
│       ├── [3.5K]  cmdq_reg.h
│       ├── [ 33K]  cmdq_sec.c
│       ├── [2.8K]  cmdq_sec.h
│       ├── [ 282]  cmdq_struct.h
│       ├── [1.8K]  cmdq_subsys_common.h
│       ├── [ 97K]  cmdq_test.c
│       ├── [ 33K]  cmdq_virtual.c
│       ├── [4.2K]  cmdq_virtual.h
│       ├── [4.0K]  inc
│       │   ├── [4.0K]  cmdq_sec_dr
│       │   │   └── [4.6K]  cmdq_sec_iwc_common.h
│       │   └── [4.0K]  cmdq_sec_tl
│       │       └── [1.2K]  cmdqSecTl_Api.h
│       └── [1.8K]  Makefile
├── [ 311]  README.md
└── [4.0K]  scripts
    ├── [ 699]  decode_ioctl.py
    ├── [ 505]  get_string_by_index.py
    └── [1.2K]  mtk-su_string_table_zlib.py

7 directories, 36 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!