PT-2020-11521 · Google · Android

Published 2020-06-11 · Updated 2021-07-21 · CVE-2020-0160

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to a missing bounds check in the setSyncSampleParams function of SampleTable.cpp, which could lead to resource exhaustion. This might result in a remote denial of service, and no additional execution privileges are needed for exploitation. User interaction is required for this issue to be exploited.

Recommendations For Android version Android-10, consider applying configuration changes or workarounds to mitigate the risk of resource exhaustion due to the missing bounds check in the setSyncSampleParams function. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-20

CWE-770

Related Identifiers

CVE-2020-0160

Affected Products

Android

References · 3

• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0160 · Security Note