CVE-2022-20099
📋 TL;DR
CVE-2022-20099 is an out-of-bounds write vulnerability in the aee daemon on MediaTek devices, allowing local privilege escalation to System level without user interaction. This affects Android devices using MediaTek chipsets, potentially enabling attackers to gain full system control.
💻 Affected Systems
- Android devices with MediaTek chipsets
📦 What is this software?
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with System privileges, allowing installation of persistent malware, data theft, and bypassing all security controls.
Likely Case
Local attacker gains System privileges to install malicious apps, modify system files, or access protected data.
If Mitigated
Limited impact if devices are patched, have strict app installation policies, and minimal local attack surface.
🎯 Exploit Status
Requires local access and System execution privileges to trigger, but no user interaction needed. No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware with patch ID ALPS06296442
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/May-2022
Restart Required: Yes
Instructions:
1. Check with device manufacturer for firmware updates. 2. Apply MediaTek security patch ALPS06296442. 3. Reboot device after update.
🔧 Temporary Workarounds
Disable unnecessary daemons
androidRestrict aee daemon permissions if not required for device functionality
adb shell pm disable com.mediatek.aee (if applicable and safe)
🧯 If You Can't Patch
- Restrict physical access to devices and implement strict app installation policies
- Monitor for suspicious privilege escalation attempts and unusual system daemon activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version against MediaTek security bulletin or contact device manufacturerCheck Version:
adb shell getprop ro.build.fingerprint or check Settings > About PhoneVerify Fix Applied:
Verify patch ALPS06296442 is applied in firmware version information📡 Detection & Monitoring
Log Indicators:
- Unusual aee daemon crashes
- Privilege escalation attempts in system logs
- Unexpected System process spawns
Network Indicators:
- None - local exploit only
SIEM Query:
Process creation where parent_process contains 'aee' AND process_integrity_level changes to SYSTEM