SB2020051428 - Multiple vulnerabilities in Google Android

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020051428

SB2020051428 - Multiple vulnerabilities in Google Android

Published: May 14, 2020 Updated: February 23, 2024

Security Bulletin ID SB2020051428
Severity
High
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 7% Low 93%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0096)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within the Framework functionality of Android due to a confused deputy in startActivities of "ActivityStartController.java". A local user can gain elevated privileges on the target system.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0097)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists within the Framework functionality of Android due to a missing condition for system apps in various methods of "PackageManagerService.java". A local user can gain elevated privileges on the target system.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0098)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within the Framework functionality of Android due to a confused deputy in navigateUpToLocked of "ActivityStack.java". A local user can gain elevated privileges on the target system.


4) Out-of-bounds write (CVE-ID: CVE-2020-0094)

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the Media framework functionality in "setImageHeight" and "setImageWidth" of ExifUtils.cpp. A local user can trigger out-of-bounds write and execute arbitrary code on the target system with elevated privileges.


5) Out-of-bounds read (CVE-ID: CVE-2020-0100)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to incorrect error handling in "onTransact" of "IHDCP.cpp" within the Media framework functionality. A local user can trigger out-of-bounds read error and read contents of memory on the system.


6) Out-of-bounds read (CVE-ID: CVE-2020-0093)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a missing bounds check in "exif_data_save_data_entry" of "exif-data.c" file within the Media framework functionality. A local user can trigger out-of-bounds read error and read contents of memory on the system.


7) Information disclosure (CVE-ID: CVE-2020-0101)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to uninitialized data in "BnCrypto::onTransact" of "ICrypto.cpp" within the Media framework functionality. A local user can gain unauthorized access to sensitive information on the system.


8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0105)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a missing permission check in "onKeyguardVisibilityChanged" of "key_store_service.cpp" within the System functionality. A local user can gain elevated privileges on the target system, allowing apps to use keyguard-bound keys when the screen is locked.


9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0109)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a missing permission check in "simulatePackageSuspendBroadcast" of "NotificationManagerService.java" within the System functionality. A local user can create fake system notifications and gain elevated privileges on the target system.


10) Out-of-bounds write (CVE-ID: CVE-2020-0102)

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in "GattServer::SendResponse" of "gatt_server.cc" within the System functionality. A local user can trigger out-of-bounds write and execute arbitrary code on the target system with elevated privileges.


11) Information disclosure (CVE-ID: CVE-2020-0092)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a permissions bypass in "setHideSensitive" of "NotificationStackScrollLayout.java" within the System functionality. A local user can gain unauthorized access to sensitive information on the system.


12) Information disclosure (CVE-ID: CVE-2020-0104)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a logic error in "onShowingStateChanged" of "KeyguardStateMonitor.java" within the System functionality. A local user can gain unauthorized access to sensitive information of keyguard-protected data.


13) Information disclosure (CVE-ID: CVE-2020-0106)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a missing SDK version check in "getCellLocation" of "PhoneInterfaceManager.java" within the System functionality. A local user can gain unauthorized access to sensitive information on the system.


14) Incorrect default permissions (CVE-ID: CVE-2020-0024)

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application in "onCreate" of "SettingsBaseActivity.java" within the System functionality. A local attacker can view contents of files and directories or modify them.


15) Buffer overflow (CVE-ID: CVE-2020-0103)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in "a2dp_aac_decoder_cleanup" of "a2dp_aac_decoder.cc" within the System functionality. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References