Loading vulnerability…
CVE-2020-0069 is an out-of-bounds write vulnerability in the ioctl handlers of the Mediatek Command Queue driver in the Android kernel. The vulnerability arises from insufficient input sanitization and missing SELinux restrictions, allowing a local attacker to perform arbitrary memory writes. This can be exploited by a local app to escalate privileges to root without requiring additional execution privileges or user interaction. The vulnerability was actively exploited in the wild by the AbstractEmu Android rooting malware, which leveraged it to gain root access on a wide range of devices.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a proof-of-concept (PoC) exploit for CVE-2020-0069, targeting the Xiaomi Redmi 6a (Mediatek MT6762M SoC) running a vulnerable Android kernel. The exploit consists of: - A C program (kernel_rw.c) that enables arbitrary kernel memory read/write by exploiting the /dev/mtk_cmdq device driver. - A shell script (poc.sh) that automates the process of locating the kernel version string in memory, patching it, and writing it back to demonstrate the exploit's capabilities. - A C shared library (syscall_hook.c) for tracing the mtk-su binary, which is not the main exploit but aids in analysis. The repository is structured with JNI source files (C code and Mediatek header files) under the jni/ directory, a build system for Android NDK, and the PoC script at the root. The exploit demonstrates the ability to read and write arbitrary kernel memory, which can be leveraged for privilege escalation or further attacks. The main attack vector is local, requiring code execution on the target device (e.g., via adb shell). The exploit is a functional PoC and not weaponized, as it requires manual steps and is tailored for research and demonstration purposes.
This repository implements a local privilege escalation (LPE) exploit for CVE-2020-0069, targeting MediaTek-based Android devices (such as the MT6739 SoC) running vulnerable kernels (tested on Android 8.1.0). The exploit is written in C++ and is structured as a standalone binary, with the main entry point in src/main.cpp. The codebase is modular, with separate components for kernel symbol resolution (kallsyms), SELinux status manipulation, and process credential escalation. The exploit works by leveraging a vulnerability in the MediaTek command queue (cmdq) driver to gain arbitrary kernel read/write access. It then disables SELinux enforcing mode by directly modifying kernel memory and overwrites the current process's credentials with those of the root process, effectively granting root privileges. Finally, it spawns a root shell (/system/bin/sh) for the attacker. The exploit requires building with the Android NDK and running on a compatible, vulnerable device. Notable fingerprintable endpoints include the SELinux enforcement file and the system shell path. The code is operational and provides a working root shell if successful.
This repository is an operational exploit toolkit for rooting MediaTek-based Android devices vulnerable to CVE-2020-0069 (mtk-su). The main entry point is 'mtk-su.py', a Python script that interacts with the device via ADB using the pure-python-adb library. The toolkit supports both system-mode (SuperSU) and bootless-mode (Magisk) rooting, as well as an unroot option. The exploit works by pushing architecture-specific binaries and shell scripts to the device, then executing them to gain root privileges. The scripts handle remounting system partitions, copying and installing root binaries, patching SELinux, and managing root management apps. The repository is structured with Python modules for device interaction and configuration, and shell scripts for on-device actions. No network endpoints are present; all actions are performed locally via ADB. The exploit is not part of a framework and is operational, requiring user interaction and device access. The main targets are MediaTek Android devices with vulnerable SoCs, and the result is root access with the option to install Magisk or SuperSU, or to unroot the device.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.