CVE-2020-0069

What Are MediaTek Chipsets?

MediaTek is one of the largest suppliers of system-on-chip platforms for Android devices, particularly common in budget and mid-range smartphones across a huge range of manufacturers worldwide. This CVE became widely known in the Android rooting community under the informal name "MediaTek-su" — a tool built around this exact flaw that let users root MediaTek-based devices with a single command, a capability that inevitably got repurposed for malicious use as well.

Overview

CVE-2020-0069 is an insufficient input validation vulnerability (CWE-787, out-of-bounds write) in MediaTek's Command Queue driver, caused by missing SELinux restrictions on its ioctl handlers, allowing local privilege escalation (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). It was later documented by Lookout as part of the AbstractEmu rooting malware framework, chained with CVE-2020-0041 (a Binder driver bug, also enriched on this site) and CVE-2019-2215.

Technical Details

The Command Queue driver's ioctl handlers accept input without adequate validation and lack the SELinux policy restrictions that would otherwise contain the impact of a compromised or malicious component, allowing a local attacker to trigger an out-of-bounds write that corrupts kernel memory and escalates privileges to root. Because the bug is broadly applicable across many MediaTek chipset variants, it became a popular and reliable rooting primitive well beyond its original security-relevant context.

Discovery

Fixed as part of Android's March 2020 security bulletin. Its exploitation via the "MediaTek-su" tooling became widely known in Android enthusiast communities, and Lookout's October 2021 research documented its use in the AbstractEmu malware chain distributed through app stores including Google Play.

Exploitation Context

This vulnerability is a notable example of a bug with dual-use history: legitimate rooting-community tooling built around it for enthusiasts wanting root access on their own devices, and the same underlying primitive later incorporated into AbstractEmu's malicious rooting chain — used without consent to fully compromise victim devices and bypass Android's permission model entirely.

Remediation

1. Apply the March 2020 Android security patch level or later on any MediaTek-based device via your manufacturer's update mechanism.
2. Retire devices that no longer receive security updates, particularly budget MediaTek-based devices that manufacturers often support for shorter periods.
3. Only install apps from trusted sources, and treat unexpected rooting or permission-model bypass on a device as a serious compromise indicator.
4. Treat this CVE and CVE-2020-0041 together when assessing Android fleet risk, since both are components of the same documented AbstractEmu exploitation chain.