CVE-2020-0380: Critical severity Google Android vulnerability

Published Sep 8, 2020

Updated

In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-146398979

Affected Software

6 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2020-09-01

Event History

Sep 8, 2020

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 17, 2020

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-0380?

CVE-2020-0380 has a critical severity due to the potential for remote code execution.

How do I fix CVE-2020-0380?

To fix CVE-2020-0380, update your Android device to the latest security patch provided by Google.

Which Android versions are affected by CVE-2020-0380?

CVE-2020-0380 affects Android versions 8.0, 8.1, 9.0, 10.0, and 11.0.

What type of attack is possible with CVE-2020-0380?

CVE-2020-0380 could allow attackers to perform remote code execution without user interaction.

Is user interaction required to exploit CVE-2020-0380?

No, user interaction is not needed for exploitation of CVE-2020-0380.