MediaTek security vulnerability allowed root access on devices from Nokia, Amazon, BLU, Sony, ZTE, and others

Security vulnerabilities are unfortunately extremely common in smartphones, given the complexity and varying codebases of most devices. That’s why Google has been releasing monthly security patches for years, and if you needed another reason for why those updates are so important, the March 2020 release fixes a critical flaw on many MediaTek devices.

One of the vulnerabilities fixed in the March security patch is CVE-2020-0069, a security flaw that affects the Command Queue driver on devices with certain MediaTek processors. As XDA Developers pointed out in an investigative piece, the vulnerability was first discovered in February 2019 by a developer looking for a way to root Amazon’s Fire tablets. The developer, known as ‘diplomatic’ on the XDA Forums, later released a script that used the vulnerability to temporarily gain root access on Fire tablets.

It was later discovered that the vulnerability, nicknamed ‘MediaTek-su,’ was also present on many other phones and tablets using MediaTek processors. Here’s the full list of confirmed devices, courtesy of XDA Developers:

Since MediaTek-su is now a year old, some OEMs have already caught on and patched their devices — Fire OS has been fixed for months, for example. According to research from developer Diplomatic, phones from Vivo, Huawei/Honor, Oppo, and Samsung have kernel modifications in place that prevented the exploit from working in its released form. Furthermore, the exploit only maintained root until the device was rebooted.

Three apps that were reportedly using MediaTek-su to gain root access, which have now been removed from the Play Store (credit: TrendMicro)

This is also one of the rare examples of an Android security vulnerability that has been exploited in the wild. A security report from TrendMicro in January claimed that several now-removed Play Store apps used one of two exploits — MediaTek-su or CVE-2019-2215 (which was fixed in the October patch) — to gain root access if it detected the user’s device was vulnerable. This report was likely how Google discovered the flaw.

Long story short, if you have a phone or tablet with a MediaTek processor, you should install the next system update you get as soon as possible. You can check if your device is vulnerable by running the original root script from XDA — if you enter a root shell (the symbol changes from a $ to a #), the exploit works.