CVE-2020-0424: Medium severity Google Android vulnerability
In sendvc of ressend.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/modules/DnsResolverto a version that resolves this vulnerability.Fixed in 11-next:2020-11-01 - Upgrade
Upgrade
android/platform/bionicto a version that resolves this vulnerability.Fixed in 9:2020-11-01 - Upgrade
Upgrade
android/platform/system/netdto a version that resolves this vulnerability.Fixed in 10:2020-11-01 - Upgrade
Upgrade
android/platform/packages/modules/DnsResolverto a version that resolves this vulnerability.Fixed in 11:2020-11-01
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low-level privileges on an affected Android device. No user interaction or additional execution privileges are required.
What is the impact of successful exploitation?
Successful exploitation can disclose information through an out-of-bounds read. The provided CVSS vector indicates no integrity or availability impact.
Which Android versions are listed as affected?
Android 9, Android 10, and Android 11 are listed as affected.
Is a fix available?
Yes. A patch is available, with remediation information referenced in the November 2020 Android security bulletin.