PT-2020-11475 · Google · Android

Published 2020-06-10 · Updated 2021-07-21 · CVE-2020-0114

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description A possible confused deputy issue exists due to a PendingIntent error in the onCreateSliceProvider of KeyguardSliceProvider.java. This could lead to local escalation of privilege, allowing actions to be performed as the System UI without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android version Android-10, consider restricting access to the KeyguardSliceProvider until a patch is available. As a temporary workaround, review and limit the use of PendingIntent to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-0114

Affected Products

Android

References · 5

• 🔥 https://github.com/tea9/CVE-2020-0114-systemui · Exploit
• https://source.android.com/security/bulletin/2020-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0114 · Security Note
• https://t.me/cibsecurity/12661 · Telegram Post