PT-2020-11441 · Google · Android Kernel

Published 2020-04-17 · Updated 2020-04-22 · CVE-2020-0076

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a missing bounds check in the get auth result function of the FPC IRIS TrustZone app, which could lead to a possible out of bounds write. This could result in local escalation of privilege, with System execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android kernel, consider applying a patch that includes a bounds check in the get auth result function to prevent out of bounds writes. As a temporary workaround, restrict access to the FPC IRIS TrustZone app to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-0076

Affected Products

Android Kernel

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-0076 · Security Note
• https://source.android.com/security/bulletin/2020-04-01 · Note
• https://t.me/cvenotify/2907 · Telegram Post