Lucene search

[email protected]CVE-2019-20607

HistoryMar 24, 2020 - 8:15 p.m.

CVE-2019-20607

2020-03-2420:15:13

CWE-787

[email protected]

web.nvd.nist.gov

samsung

mobile devices

nvd

cve-2019-20607

security issue

heap overflow

keymaster trustlet

arbitrary code execution

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.5%

JSON

An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory, and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019).

Affected configurations

NVD

Node

googleandroidMatch7.0

googleandroidMatch7.1.0

googleandroidMatch7.1.1

googleandroidMatch7.1.2

googleandroidMatch8.0

googleandroidMatch8.1

googleandroidMatch9.0

AND

qualcommmsm8996Match-

qualcommmsm8998Match-

samsungexynos_7420Match-

samsungexynos_7870Match-

samsungexynos_8890Match-

samsungexynos_8895Match-

CPENameOperatorVersion
google:androidgoogle androideq7.0
google:androidgoogle androideq7.1.0
google:androidgoogle androideq7.1.1
google:androidgoogle androideq7.1.2
google:androidgoogle androideq8.0
google:androidgoogle androideq8.1
google:androidgoogle androideq9.0

CPE	Name	Operator	Version
google:android	google android	eq	7.0
google:android	google android	eq	7.1.0
google:android	google android	eq	7.1.1
google:android	google android	eq	7.1.2
google:android	google android	eq	8.0
google:android	google android	eq	8.1
google:android	google android	eq	9.0

References

security.samsungmobile.com/securityUpdate.smsb

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.5%

JSON

Related for CVE-2019-20607

nvd1 prion1 cvelist1