PT-2020-11782 · Google · Android

Published 2020-11-01 · Updated 2022-07-12 · CVE-2020-0439

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description The issue is related to an incorrect permission check in the generatePackageInfo function of PackageManagerService.java. This could lead to local escalation of privilege, allowing instant apps to access permissions not allowed for them without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android versions 8.0 through 11, consider restricting access to instant apps until a patch is available. As a temporary workaround, review and restrict permissions assigned to instant apps to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-140256621

CVE-2020-0439

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/ASB-A-140256621 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0439 · Vendor Advisory
• https://source.android.com/security/bulletin/2020-11-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0439 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/c46491e7da14c620fbe490d50b61aa65f256c5d3 · Note
• https://t.me/cibsecurity/16074 · Telegram Post
• https://t.me/cvenotify/5437 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/e752ae55522f2657bb26bd2351ef879a73fa6efb · Note