PT-2020-15915 · Samsung · Knoxcontainer+1

Published 2020-08-31 · Updated 2020-09-03 · CVE-2020-25055

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with O(8.x) software Samsung mobile devices with P(9.0) software Samsung mobile devices with Q(10.0) software

Description An issue was discovered that allows attackers, who control an unprivileged SecureFolder process, to bypass admin restrictions in KnoxContainer.

Recommendations For Samsung mobile devices with O(8.x) software, update to a version that includes the fix for this issue. For Samsung mobile devices with P(9.0) software, update to a version that includes the fix for this issue. For Samsung mobile devices with Q(10.0) software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the persona service to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-25055

Affected Products

Knoxcontainer

Secure Folder

References · 3

• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25055 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25055 · Vendor Advisory