PT-2020-11803 · Google · Android

Published 2020-12-01 · Updated 2020-12-15 · CVE-2020-0464

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description A possible side channel information disclosure exists in the resolv cache lookup function of res cache.cpp. This issue could lead to local information disclosure of accessed web resources without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android version Android-10, apply the fix provided by the Android security patch to resolve the issue.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ASB-A-150371903

CVE-2020-0464

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/CVE-2020-0464 · Vendor Advisory
• https://source.android.com/security/bulletin/2020-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-150371903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0464 · Security Note
• https://android.googlesource.com/platform/frameworks/native/+/f1cf6a632da354cff3d8aed54913e1ee2909908e · Note
• https://android.googlesource.com/platform/system/netd/+/e1ec3b167754930d4d87b48414f9d707554a02f0 · Note