PT-2020-11555 · Google · Android

Published 2020-06-11 · Updated 2020-06-15 · CVE-2020-0196

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to improper input validation in the RegisterNotificationResponse::GetEvent function, which could lead to a remote denial of service of the Bluetooth service over Bluetooth, without requiring additional execution privileges. User interaction is not needed for exploitation.

Recommendations For Android version Android-10, consider disabling the Bluetooth service until a patch is available to prevent remote denial of service attacks. Restrict access to the Bluetooth functionality to minimize the risk of exploitation. Avoid using the Bluetooth service in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-0196

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2020-0196 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0196 · Security Note
• https://t.me/cvenotify/4313 · Telegram Post