PT-2020-11384 · Google · Android

Published 2020-02-13 · Updated 2021-07-21 · CVE-2020-0015

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 10

Description A potential issue in the onCreate method of CertInstaller.java allows a malicious application to overlay the Certificate Installation dialog. This could lead to local escalation of privilege without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations For Android versions 8.0 through 10, consider restricting access to the Certificate Installation dialog until a patch is available. As a temporary workaround, avoid installing certificates from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2020-0015

Affected Products

Android

References · 3

• https://osv.dev/vulnerability/CVE-2020-0015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0015 · Security Note
• https://source.android.com/security/bulletin/2020-02-01 · Vendor Advisory