PT-2020-13244 · Google · Android

Max Thomas · Published 2020-05-11 · Updated 2022-04-26 · CVE-2020-12753

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LG mobile devices with Android OS versions 7.2, 8.0, 8.1, 9, and 10

Description An issue was discovered that allows arbitrary code execution via the bootloader due to an EL1/EL3 coldboot vulnerability involving raw resources. This vulnerability can be exploited for attacks, and it has been reported that LG smartphones were vulnerable to such attacks for around 7 years.

Recommendations For LG mobile devices with Android OS versions 7.2, 8.0, 8.1, 9, and 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-12753

Affected Products

Android

References · 9

• 🔥 https://github.com/shinyquagsire23/CVE-2020-12753-PoC · Exploit
• 🔥 https://douevenknow.us/post/619763074822520832/an-el1el3-coldboot-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12753 · Security Note
• https://lgsecurity.lge.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12753 · Vendor Advisory
• https://t.me/hnews/29574 · Telegram Post
• https://t.me/defcon_news/48631 · Telegram Post
• https://t.me/cybersecuritytechnologies/1269 · Telegram Post
• https://zdnet.com/article/new-cold-boot-attack-affects-seven-years-of-lg-android-smartphones · Note