PT-2020-11780 · Google · Android

Published 2020-11-01 · Updated 2022-07-12 · CVE-2020-0437

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-8.0 through Android-11

Description In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service of emergency alerts with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android versions Android-8.0 through Android-11, consider disabling the CellBroadcastReceiver's intent handlers as a temporary workaround until a patch is available. Restrict access to emergency alerts to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-162741784

CVE-2020-0437

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2020-11-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0437 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-162741784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0437 · Security Note
• https://t.me/cibsecurity/16083 · Telegram Post
• https://android.googlesource.com/platform/packages/apps/CellBroadcastReceiver/+/ceb90c636ce0d766f80cfcd522bb27b37e6d37c9 · Note
• https://t.me/cvenotify/5440 · Telegram Post