PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2020-0069: Autopsy of the Most Stable MediaTek Rootkit

blog.quarkslab.com | vulnerability | CVE-2020-0069 | #privilege-escalation | #android | #kernel | #rootkit | #mediatek | #cve-2020-0069
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Autopsy of CVE-2020-0069 in MediaTek's CMDQ driver, which allowed local attackers to read and write physical memory for privilege escalation and enabled the long-lived mtk-su rooting tool.
CVE
CVE-2020-0069
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
vulnerability · eshard.com
[CVE-2023-20938] Kernel UaF to Root #1: Freeing an Object That’s Still in Use
A use-after-free in Android’s Binder driver, recorded once and replayed at will. Part 1 of a series building a full kernel exploit chain with time travel debugging.
blog · blog.trailofbits.com
From The Depths Of Counterfeit Smartphones
Teardowns of counterfeit iPhone and Samsung clones show convincing exteriors hiding Mediatek hardware, unpatched vulnerabilities, insecure bloatware, and preinstalled malware and rootkits.
blog · projectzero.google
BitUnmap: Attacking Android Ashmem
A Project Zero post on attacking Android's ashmem shared memory interface, showing how wrong assumptions about its internals led to bugs in core system code.
blog · projectzero.google
Windows Drivers are True’ly Tricky
A bug in the TrueCrypt Windows driver, despite prior security audits, lets a normal user or low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or kernel.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
Back