PT-2020-11595 · Google · Android

Published 2020-08-01 · Updated 2020-08-12 · CVE-2020-0240

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description In the NewFixedDoubleArray of factory.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

Recommendations For Android version Android-10, update to a version that fixes the integer overflow issue in NewFixedDoubleArray of factory.cc to prevent potential remote code execution.

Fix

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

ASB-A-150706594

CVE-2020-0240

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/ASB-A-150706594 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0240 · Vendor Advisory
• https://source.android.com/security/bulletin/2020-08-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0240 · Security Note
• https://t.me/cibsecurity/14072 · Telegram Post
• https://android.googlesource.com/platform/external/v8/+/cb30bc6720cb3864d1a9f9c55b7d53ab2d9a5f7a · Note