PT-2020-11771 · Google · Android

Published 2020-10-01 · Updated 2021-07-21 · CVE-2020-0421

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description The issue is related to incorrect error handling in the appendFormatV function of String8.cpp, which could lead to a possible out of bounds write. This might result in local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android versions 8.0 through 11, update to a version that includes the fix for the out of bounds write issue in String8.cpp.

Fix

Memory Corruption

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-787

CWE-755

Related Identifiers

ASB-A-161894517

CVE-2020-0421

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2020-10-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-161894517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0421 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0421 · Vendor Advisory
• https://android.googlesource.com/platform/system/core/+/bad50ed24f9d48d001fcedd332d59f162dc3432d · Note