CVE-2020-0415: Medium severity Google Android vulnerability
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.0 Android-8.1Android ID: A-156020795
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify SystemUI code to remove unsafe PendingIntent usage that allows permission bypass. Ensure PendingIntents are created so they cannot be abused to access contact data (enforce required permissions and do not expose intents to untrusted callers).
Android SystemUI PendingIntent handling = avoid unsafe/exposed PendingIntents; enforce required permissions or appropriate intent flags when creating PendingIntents - Compensating control
Until SystemUI is fixed, limit exposure by restricting untrusted/local apps from interacting with SystemUI components and limit installation/execution of untrusted apps on affected devices; where possible restrict access to contact data to trusted apps only.
- Operational
Audit devices for potential local information disclosure of contact data (check access logs and recent app interactions with contacts via SystemUI) and investigate/notify impacted users if exposures are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-0415?
CVE-2020-0415 is classified as a medium severity vulnerability due to the potential for local information disclosure.
How do I fix CVE-2020-0415?
To fix CVE-2020-0415, update your Android device to the latest security patch level that addresses this vulnerability.
Which Android versions are affected by CVE-2020-0415?
CVE-2020-0415 affects Android versions 8.0, 8.1, 9.0, 10.0, and 11.0.
What can be exploited through CVE-2020-0415?
CVE-2020-0415 can be exploited to bypass permissions leading to local information disclosure of contact data.
Does CVE-2020-0415 require user interaction for exploitation?
No, exploitation of CVE-2020-0415 does not require user interaction.