CVE-2020-0009

🗓️ 08 Jan 2020 15:31:49Reported by google_androidType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 199 Views🌐 WEB

Possible arbitrary write to shared memory in ashmem.c, leading to local escalation of privilege

Reporter	Title	Published	Views	Family All 50
0day.today	Android ashmem Read-Only Bypasses Exploit	10 Jan 202000:00	–	zdt
0day.today	WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM Exploit	14 Jan 202000:00	–	zdt
0day.today	Android - ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN Exploit	15 Jan 202000:00	–	zdt
Android Security Bulletins	Android Security Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Android Security Bulletins	Pixel Update Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Circl	CVE-2020-0009	14 Jan 202000:00	–	circl
CNVD	Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2020-02990)	7 Jan 202000:00	–	cnvd
Cvelist	CVE-2020-0009	8 Jan 202015:31	–	cvelist
Debian	[SECURITY] [DLA 2241-1] linux security update	9 Jun 202021:29	–	debian
Debian	[SECURITY] [DLA 2241-2] linux security update	10 Jun 202010:55	–	debian

NVD

Node

google androidMatch-

Node

debian debian_linuxMatch8.0

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android kernel"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00011.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00013.html
source	www.source.android.com/security/bulletin/2020-01-01

Parameter	Position	Path	Description	CWE
ASHMEM_SET_SIZE	path	/dev/ashmem	Arbitrary write to ashmem via protection bypass and remap_file_pages, enabling modification of shared memory mappings.	CWE-276
ASHMEM_SET_PROT_MASK	path	/dev/ashmem	Arbitrary write to ashmem via protection bypass and remap_file_pages, enabling modification of shared memory mappings.	CWE-276
ASHMEM_UNPIN	path	/dev/ashmem	Arbitrary write to ashmem via protection bypass and remap_file_pages, enabling modification of shared memory mappings.	CWE-276

17 Jun 2026 02:44Current

6.2Medium risk

Vulners AI Score6.2

CVSS 22.1

CVSS 3.15.5

EPSS0.00687

CWE-276