Actively exploited · Published Mar 10, 2020 · Assigned by google_android
CVE-2020-0041
High 7.8 Exploited
In plain English
A high-severity improper input validation in Android. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.4.6-1 | DEBIAN-CVE-2020-0041 |
| Debian:13 | linux | 5.4.6-1 | DEBIAN-CVE-2020-0041 |
| Debian:14 | linux | 5.4.6-1 | DEBIAN-CVE-2020-0041 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-0041 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-0041 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-0041 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-0041 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://source.android.com/security/bulletin/2020-03-01 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0041 government-resource