PT-2020-6560 · Google · Android

Published 2020-06-01 · Updated 2021-07-21 · CVE-2020-0188

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to a permissions bypass in the onCreatePermissionRequest function of SettingsSliceProvider.java due to a PendingIntent error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. The vulnerability is associated with insecure privilege management, which could allow an attacker to elevate their privileges.

Recommendations For Android version Android-10, consider restricting access to the SettingsSliceProvider.java until a patch is available. As a temporary workaround, review and restrict PendingIntent usage to minimize the risk of exploitation. Avoid using the onCreatePermissionRequest function in SettingsSliceProvider.java until the issue is resolved.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-00149

CVE-2020-0188

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2020-0188 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0188 · Security Note
• https://bdu.fstec.ru/vul/2022-00149 · Security Note