CVE-2020-0009

🗓️ 08 Jan 2020 15:31:49Reported by google_androidType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 257 Views🌐 WEB

Possible arbitrary write to shared memory in ashmem.c, leading to local escalation of privilege

Reporter	Title	Published	Views	Family All 51
zdt	Android ashmem Read-Only Bypasses Exploit	10 Jan 202000:00	–	zdt
zdt	WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM Exploit	14 Jan 202000:00	–	zdt
zdt	Android - ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN Exploit	15 Jan 202000:00	–	zdt
Android Security Bulletins	Android Security Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Android Security Bulletins	Pixel Update Bulletin—January 2020Stay organized with collectionsSave and categorize content based on your preferences.	6 Jan 202000:00	–	androidsecurity
Circl	CVE-2020-0009	14 Jan 202000:00	–	circl
CNVD	Google Android Kernel Component Elevation of Privilege Vulnerability (CNVD-2020-02990)	7 Jan 202000:00	–	cnvd
Cvelist	CVE-2020-0009	8 Jan 202015:31	–	cvelist
Debian	[SECURITY] [DLA 2241-1] linux security update	9 Jun 202021:29	–	debian
Debian	[SECURITY] [DLA 2241-2] linux security update	10 Jun 202010:55	–	debian

NVD

Node

google androidMatch-

Node

debian debian_linuxMatch8.0

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android kernel"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00011.html
lists	www.lists.debian.org/debian-lts-announce/2020/06/msg00013.html
source	www.source.android.com/security/bulletin/2020-01-01

Parameter	Position	Path	Description	CWE
addr	path	/dev/ashmem	Remap_file_pages-based attack on ashmem can raise write permissions on the backing shared memory by manipulating VM permissions, bypassing protection checks and enabling arbitrary writes.	CWE-276
size	path	/dev/ashmem	Remap_file_pages-based attack on ashmem can raise write permissions on the backing shared memory by manipulating VM permissions, bypassing protection checks and enabling arbitrary writes.	CWE-276
prot	path	/dev/ashmem	Remap_file_pages-based attack on ashmem can raise write permissions on the backing shared memory by manipulating VM permissions, bypassing protection checks and enabling arbitrary writes.	CWE-276
pgoff	path	/dev/ashmem	Remap_file_pages-based attack on ashmem can raise write permissions on the backing shared memory by manipulating VM permissions, bypassing protection checks and enabling arbitrary writes.	CWE-276
flags	path	/dev/ashmem	Remap_file_pages-based attack on ashmem can raise write permissions on the backing shared memory by manipulating VM permissions, bypassing protection checks and enabling arbitrary writes.	CWE-276
ASHMEM_UNPIN	path	/dev/ashmem	ASHMEM_UNPIN can purge ashmem pages even when the mapping is read-only, enabling memory zeroing under pressure and potential exploitation without proper access control.	CWE-276
struct ashmem_pin { offset, len }	path	/dev/ashmem	ASHMEM_UNPIN can purge ashmem pages even when the mapping is read-only, enabling memory zeroing under pressure and potential exploitation without proper access control.	CWE-276