Out-of-bounds write in Google Android - CVE-2020-0041
Published: March 10, 2020 / Updated: August 31, 2023
Vulnerability identifier: #VU34785
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-0041
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local authenticated user to execute arbitrary code.
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel
Affected software
Google Android
How to mitigate CVE-2020-0041
Install update from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #9266 - CVE-2020-0041-Pixel-3a (Local privilege escalation exploit for Android Binder bug CVE-2020-0041 (Pixel 3a)) (August 31, 2023)
- Exploit #9185 - CVE-2020-0041-Pixel-3a (Local privilege escalation exploit for Android Binder bug CVE-2020-0041 (Pixel 3a)) (July 15, 2023)
- Exploit #7674 - CVE-2020-0041 () (April 21, 2022)
- Exploit #6473 - CVE-2020-0041 (My implementation of CVE-2020-0041) (June 25, 2021)
- Exploit #5539 - CVE_2020_0041 (My implementation for an exploit of the CVE-2020-0041 bug) (June 7, 2021)
- Exploit #5140 - CVE-2020-0041 () (February 11, 2021)
- Exploit #4516 - CVE-2020-0041 (Exploits for Android Binder bug CVE-2020-0041) (August 21, 2020)
- Exploit #4515 - CVE-2020-0041 () (August 21, 2020)
- Exploit #4514 - CVE-2020-0041-Original () (August 21, 2020)
- Exploit #4504 - CVE-2020-0041 () (August 21, 2020)