Vulnerability · Published May 11, 2020 · Assigned by mitre

CVE-2020-12753

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.5%top 15.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving raw_resources. The LG ID is LVE-SMP-200006 (May 2020).

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lgsecurity.lge.com/ x_refsource_CONFIRM
https://www.zdnet.com/article/new-cold-boot-attack-affects-seven-years-of-lg-android-smartphones/ x_refsource_MISC
https://douevenknow.us/post/619763074822520832/an-el1el3-coldboot-vulnerability x_refsource_MISC