Lucene search

[email protected]CVE-2020-0427

HistorySep 17, 2020 - 7:15 p.m.

CVE-2020-0427

2020-09-1719:15:12

CWE-416

CWE-125

[email protected]

web.nvd.nist.gov

368

cve-2020-0427

android

kernel

nvd

security vulnerability

out of bounds read

use after free

local information disclosure

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.8

Confidence

High

EPSS

Percentile

5.1%

JSON

In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171

Affected configurations

NVD

Node

googleandroidMatch-

Node

debiandebian_linuxMatch9.0

Node

opensuseleapMatch15.1

opensuseleapMatch15.2

Node

starwindsoftwarestarwind_virtual_sanMatchv8build12533vsphere

starwindsoftwarestarwind_virtual_sanMatchv8build12658vsphere

starwindsoftwarestarwind_virtual_sanMatchv8build12859vsphere

starwindsoftwarestarwind_virtual_sanMatchv8build13170vsphere

starwindsoftwarestarwind_virtual_sanMatchv8build13586vsphere

starwindsoftwarestarwind_virtual_sanMatchv8build13861vsphere

VendorProductVersionCPE
googleandroid-cpe:/o:google:android:-:::

Vendor	Product	Version	CPE
google	android	-	cpe:/o:google:android:-:::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Android",
    "versions": [
      {
        "version": "Android kernel",
        "status": "affected"
      }
    ]
  }
]