X

Tech

Home Tech Security

Android security: Google patches a dangerous flaw in these phones

Google has released a fix to Android partners for a MediaTek processor flaw that is already under attack.

Written by Liam Tung, Contributing Writer March 3, 2020 at 3:27 a.m. PT

Google has disclosed a severe vulnerability affecting dozens of models of mid-range Android devices running on chips from MediaTek. Malicious Android apps have been exploiting the flaw since at least January 2020.

The elevation-of-privilege flaw, tracked as CVE-2020-0069, is disclosed in Google's March 2020 Android bulletin and affects the MediaTek Command Queue driver.

Smartphones

The dangerous part about this bug is that an exploit has been floating around for almost a year called 'MediaTek-su', which enables temporary root access on a large number of MediaTek chips.

A developer who goes by the name 'diplomatic' used XDA-Developers' forums to share a script that users can run to gain superuser (su) access.

SEE: Cybersecurity: Let's get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)

While it was originally intended for rooting Amazon Fire devices to modify them, any app can incorporate MediaTek-su and execute it to gain root access in shell, according to XDA-Developers. However, a malicious app's root access won't survive a device reboot.

TrendMicro reported in January that several malicious apps available on Google Play were using MediaTek-su to gain root access on Android devices.

The apps were using the exploit to collect infected devices' location, battery status, files, a list of installed apps, screenshots and data from WeChat, Outlook, Twitter, Facebook, Gmail and Chrome. Google removed the offending apps at the time.

According to XDA-Developers, MediaTek says the vulnerability affects MediaTek devices with Linux Kernel versions 3.18, 4.4, 4.9, or 4.14 running Android versions 7 Nougat, 8 Oreo, or 9 Pie.

MediaTek devices running Android 10 are not vulnerable since "the access permission of CMDQ device nodes is also enforced by SELinux", the company said.

MediaTek actually had patches available for the flaw in May 2019, which were rolled out by Amazon for its Fire OS devices. However, many OEMs using affected MediaTek chips hadn't applied the fix and so the company reportedly sought Google's help.

Now that Google has released a fix in its Android update, users with a MediaTek device should install them from their OEM.

SEE: IT pro's guide to the evolution and impact of 5G technology (free PDF)

According to a post on XDA-Developers Forums, the MediaTek-su exploit works against dozens of cheaper devices from Acer, Huawei, Lenovo, LG, Sony and ZTE. The full list includes:

Mobility

Editorial standards

Show Comments

Related

Google Pixel 8 and Pixel 8 Pro

Google just gave two compelling reasons to update your Pixel phone

Invitation to the first public beta of Android 15

Google launches Android 15 Beta 1. Here's what's inside and how to get it

The best Android phones for 2024: Expert tested