PT-2020-11753 · Google · Android

Published 2020-10-01 · Updated 2021-07-21 · CVE-2020-0400

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-11

Description The issue is related to a possible permission bypass in the showDataRoamingNotification function of NotificationMgr.java due to an unsafe PendingIntent. This could lead to local information disclosure, requiring User execution privileges. Notably, user interaction is not necessary for exploitation.

Recommendations For Android versions Android-10 through Android-11, consider restricting access to the showDataRoamingNotification function of NotificationMgr.java until a patch is available. As a temporary workaround, disabling the use of unsafe PendingIntent in this context may help minimize the risk of exploitation.

Fix

Related Identifiers

ASB-A-153356561

CVE-2020-0400

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2020-10-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0400 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0400 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-153356561 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c · Note