PT-2020-11593 · Google · Android

Published 2020-08-01 · Updated 2024-12-24 · CVE-2020-0238

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 10

Description A logic flaw in the Settings app could lead to a confused deputy attack due to a race condition in the updatePreferenceIntents of AccountTypePreferenceLoader. This could result in local escalation of privilege and launching privileged activities with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android versions 8.0 through 10, apply the fix for the issue in the AccountTypePreferenceLoader to prevent local escalation of privilege. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

ASB-A-150946634

CVE-2020-0238

Affected Products

Android

References · 13

• https://source.android.com/security/bulletin/2020-08-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-150946634 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0238 · Security Note
• https://twitter.com/kriwarefeed/status/1864195466050564220 · Twitter Post
• https://android.googlesource.com/platform/packages/apps/Settings/+/33dd3187d0246a0425a41f76888a369c16dc9379 · Note
• https://t.me/secharvester/17589 · Telegram Post
• https://twitter.com/Tinolle1955/status/1868350839733231804 · Twitter Post
• https://t.me/cibsecurity/14074 · Telegram Post
• https://twitter.com/reverseame/status/1871503850445639975 · Twitter Post
• https://twitter.com/tbbhunter/status/1862415185559875752 · Twitter Post
• https://t.me/thebugbountyhunter/9386 · Telegram Post
• https://twitter.com/Dinosn/status/1868242418958844152 · Twitter Post