CVE-2020-0009

🗓️ 08 Jan 2020 15:31:49Reported by google_androidType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 244 Views🌐 WEB

Possible arbitrary write to shared memory in ashmem.c, leading to local escalation of privilege

Reporter	Title	Published	Views	Family All 52
zdt	Android ashmem Read-Only Bypasses Exploit	10 Jan 202000:00	–	zdt
zdt	WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM Exploit	14 Jan 202000:00	–	zdt
zdt	Android - ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN Exploit	15 Jan 202000:00	–	zdt
Android Security Bulletins	Android Security Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Android Security Bulletins	Pixel Update Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Circl	CVE-2020-0009	14 Jan 202000:00	–	circl
CNVD	Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2020-02990)	7 Jan 202000:00	–	cnvd
Cvelist	CVE-2020-0009	8 Jan 202015:31	–	cvelist
Debian	[SECURITY] [DLA 2241-1] linux security update	9 Jun 202021:29	–	debian
Debian	[SECURITY] [DLA 2241-2] linux security update	10 Jun 202010:55	–	debian

NVD

Node

google androidMatch-

Node

debian debian_linuxMatch8.0

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android kernel"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00011.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00013.html
source	www.source.android.com/security/bulletin/2020-01-01

Parameter	Position	Path	Description	CWE
prot	path	/dev/ashmem	remap_file_pages can change mapping protections for ashmem by calling remap_file_pages(mapping, 0x1000, 0, 0, 0) with prot=0, enabling write access to the ashmem backing file via mprotect.	CWE-276
ASHMEM_UNPIN	path	/dev/ashmem	ASHMEM_UNPIN has no access control for purgable ashmem memory; an attacker can unpin purgable pages and cause memory to be purged under pressure.	CWE-276
offset	path	/dev/ashmem	ASHMEM_UNPIN has no access control for purgable ashmem memory; an attacker can unpin purgable pages and cause memory to be purged under pressure.	CWE-276
len	path	/dev/ashmem	ASHMEM_UNPIN has no access control for purgable ashmem memory; an attacker can unpin purgable pages and cause memory to be purged under pressure.	CWE-276