PT-2020-16633 · Google · Android

Published 2020-12-15 · Updated 2021-07-21 · CVE-2020-27057

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android version 11

Description A permission bypass issue exists in the GpuService.cpp file, specifically in the getGpuStatsGlobalInfo and getGpuStatsAppInfo functions, due to a missing permission check. This could lead to local information disclosure of GPU statistics, requiring User execution privileges. No user interaction is needed for exploitation.

Recommendations For Android version 11, apply the fix provided by the Android security update to resolve the permission bypass issue in the GpuService.cpp file.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-27057

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/pixel/2020-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27057 · Security Note
• https://t.me/cibsecurity/20836 · Telegram Post