PT-2020-16607 · Google · Android

Published 2020-12-15 · Updated 2021-07-21 · CVE-2020-27030

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android version Android-11

Description In the onCreate method of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege, allowing an app to set or dismiss the alarm with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android version Android-11, consider restricting access to the HandleApiCalls.java class to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the onCreate method in HandleApiCalls.java to prevent potential permission bypass.

Fix

Related Identifiers

CVE-2020-27030

Affected Products

Android

References · 5

• https://osv.dev/vulnerability/CVE-2020-27030 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2020-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27030 · Security Note
• https://t.me/cvenotify/7170 · Telegram Post
• https://t.me/cibsecurity/20826 · Telegram Post