CVE-2020-0394: High severity Google Android vulnerability
In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 8.0:2020-09-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 8.1:2020-09-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 9:2020-09-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 10:2020-09-01
Event History
Frequently Asked Questions
What is the severity of CVE-2020-0394?
The severity of CVE-2020-0394 is classified as a moderate vulnerability, potentially allowing local escalation of privilege.
How do I fix CVE-2020-0394?
To fix CVE-2020-0394, users should update their Android devices to a patched version provided by Google.
Which versions of Android are affected by CVE-2020-0394?
CVE-2020-0394 affects Google Android versions 8.0, 8.1, 9.0, and 10.0.
What kind of exploit does CVE-2020-0394 enable?
CVE-2020-0394 enables a tapjacking exploit, allowing untrusted devices to gain access to contact lists.
Is user interaction required for exploiting CVE-2020-0394?
Yes, user interaction is required for exploiting CVE-2020-0394.