CVE-2019-2207: High severity Google Android vulnerability
In nfahcihandleadmingatersp of nfahciact.cc, there is a possible out of bound write due to missing bounds checks. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-124524315
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 8.0, 8.1, 9, or 10 are listed as affected. Exploitation is local, so it is relevant where an attacker can run code on the device with the required privileges.
What access does an attacker need to exploit it?
The CVSS vector specifies local access and low privileges, with no user interaction required. The vulnerability description also states that system execution privileges are needed.
What is the potential impact of successful exploitation?
Successful exploitation could result in local escalation of privilege. The stated impact includes high confidentiality, integrity, and availability effects, and could provide system execution privileges.
How can I identify the relevant fix?
The issue is tracked as Android ID A-124524315. The provided Android security bulletin is dated 2019-11-01, and a corresponding source change is referenced for the NFC component.