CVE-2020-10854: High severity Google Android vulnerability
Published Mar 24, 2020
·Updated
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Kernel stack addresses are leaked to userspace. The Samsung ID is SVE-2019-16161 (January 2020).
Affected Software
4 affected components
Google Android=8.0
Google Android=8.1
Google Android=9.0
Google Android=10.0
Event History
Mar 24, 2020
CVE Published
via MITRE·05:37 PM
Data Sourced
via MITRE·05:37 PM
Description
Frequently Asked Questions
1
Which devices and software versions are affected?
The issue affects Samsung mobile devices running Android O (8.x), P (9.0), or Q (10.0).
2
Does exploitation require local access, authentication, or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What information could an attacker obtain?
Kernel stack addresses may be leaked to userspace. The CVSS vector rates the confidentiality impact as high, with no integrity or availability impact indicated.
4
How can I identify the vendor tracking identifier for this issue?
Samsung tracks this issue as SVE-2019-16161 and associates it with its January 2020 security update information.