PT-2020-11755 · Google · Android Kernel

Published 2020-09-17 · Updated 2020-09-23 · CVE-2020-0403

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to an exposed test feature in the FPC TrustZone fingerprint App, which could lead to a local escalation of privilege in the TEE. System execution privileges are required for exploitation, and user interaction is not needed.

Recommendations For Android kernel, consider restricting access to the test feature in the FPC TrustZone fingerprint App to minimize the risk of exploitation. As a temporary workaround, disabling the exposed test feature until a patch is available may help mitigate the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-0403

Affected Products

Android Kernel

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2020-0403 · Security Note
• https://source.android.com/security/bulletin/pixel/2020-09-01 · Vendor Advisory