The March Android security figure is now ready and features the CVE-2020-0069 vulnerability pool, called MediaTek-Su and launches that the application can obtain root permissions on several devices with the MediaTek processor.
It's not a new risk, and at the XDA forums it was mentioned in April 2019 as an easy way to get rooted on Amazon and other mobile devices via MediaTek. The problem is that you are vulnerable was severely abused by malware since, at least, in January of this year.
What is MediaTek-su
It's hard to find the exact origin of MediaTek-su, or MTK-su, but about a year ago it appeared on the XDA forums as a way to get temporary roots on certain devices with MediaTek chipsets. The main advantage is that no need to boot booter gaining root access. The bad news is that the root entry was temporary: he disappeared from the restart.
Bullying is easy, because you only need it download the text, connect to mobile using ADB and enter a few commands. The problem is that in addition to being able to be used by users who want greater control over their phones, malicious apps can take advantage of their root permission. In fact, according to TrendMicro researchers, there are already apps that use this to their advantage.
According to XDA, MediaTek launched the tower for repairs in recent months, but it is the task of mobile manufacturers with SoC to use explosives and send them to devices as security updates. Now what? The solution is integrated with the March security pool, the solution is expected to reach multiple devices.
Devices affected
This vulnerability exists in MediaTek SoCs, especially for those with Kernel Linux versions 3.18, 4.4, 4.9 or 4.14 and with Android 7, 8 or 9 types. Exploit doesn't work on Android 10, so at least the storage facilities are safe. The complete list of affected chipsets is as follows:
- MT6735
- MT6737
- MT6738
- MT6739
- MT6750
- MT6753
- MT6755 (Helio P10)
- MT6757 (Helio P20)
- MT6758 (Helio P30)
- MT6761 (Helio A22)
- MT6762 (Helio P22)
- MT6763 (Helio P23)
- MT6765 (Helio P35)
- MT6771 (Helio P60)
- MT6779 (Helio P90)
- MT6795 (Helio X10)
- MT6797 (Helio X20)
- MT6799 (Helio X30)
- MT8163
- MT8167
- MT8173
- MT8176
- MT8183
- MT6580
- MT6595
Now, there are exceptions as noted in XDA. Abuse does not work on MediaTek phones from Vivo, OPPO, Huawei, Honor or Samsung with versions of Android 8,0 or higher, because they include computer modifications that render the script inactive, or "by text" may be able to create a modified version of these devices.
You can test the Linux Kernel version from Android Settings, although the most inexpensive way to check if your phone is affected by this vulnerability try the original text and see if you get root access temporarily (command change changes from $ to #).
If so, the good news is that the fix is included in March security. The bad news is that many devices with a MediaTek processor are either installation or intermediate days and are sometimes unavailable for safety starters.
Via | XDA
