PT-2020-11562 · Google · Android

Published 2020-06-11 · Updated 2020-06-15 · CVE-2020-0204

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to a Time of Check/Time of Use condition in the InstallPackage function of package.cpp, which could allow a bypass of the signature check for an OS update. This might lead to local escalation of privilege, enabling the bypass of the initial zip file signature check without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations For Android version Android-10, update to a version that includes a fix for this issue to prevent potential local escalation of privilege.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2020-0204

Affected Products

Android

References · 3

• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0204 · Security Note