CVE-2020-0033: Buffer Overflow
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144351324
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 8.0, 8.1, 9, or 10 are listed as affected. Exploitation is local, so an attacker would need access to execute code on the device.
What access does an attacker need to exploit it?
The vulnerability requires low privileges and does not require user interaction. No additional execution privileges are needed beyond the attacker’s existing local execution context.
What is the potential impact of successful exploitation?
Successful exploitation could allow local escalation of privilege. The CVSS vector indicates high impact to confidentiality, integrity, and availability.