PT-2020-11451 · Google · Android

Published 2020-03-15 · Updated 2021-07-21 · CVE-2020-0086

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to a possible out of bounds write due to an integer overflow in the readCString function of Parcel.cpp. This could potentially lead to arbitrary code execution if IntSan were not enabled, which it is by default. No additional execution privileges are required for exploitation, and user interaction is not needed.

Recommendations For Android version Android-10, consider applying the necessary patches or updates to resolve the integer overflow issue in the readCString function of Parcel.cpp. As a temporary workaround, no specific actions are recommended without further information on patch availability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-0086

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/android-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0086 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0086 · Vendor Advisory
• https://t.me/cvenotify/1709 · Telegram Post