Input validation error in Google Android - CVE-2020-0423

Vulnerability identifier: #VU47453

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-0423

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Binder component in OS kernel. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary code on the system.

Google Android
Ubuntu
openEuler
linux-image-generic-lpae (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-129-generic (Ubuntu package)
linux-image-4.15.0-129-generic-lpae (Ubuntu package)
linux-image-4.15.0-129-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1062-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-4.15.0-1077-gke (Ubuntu package)
linux-image-4.15.0-1077-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1082-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1091-aws (Ubuntu package)
linux-image-4.15.0-1091-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1094-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1103-azure (Ubuntu package)
python2-perf
python3-perf
bpftool-debuginfo
kernel-tools-devel
kernel-tools-debuginfo
python2-perf-debuginfo
kernel-source
perf
kernel-devel
perf-debuginfo
python3-perf-debuginfo
kernel
bpftool
kernel-debugsource
kernel-tools
kernel-debuginfo
linux-image-oem-osp1 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-5.4.0-56-lowlatency (Ubuntu package)
linux-image-5.4.0-56-generic-lpae (Ubuntu package)
linux-image-5.4.0-56-generic (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-58-generic (Ubuntu package)
linux-image-5.4.0-58-generic-lpae (Ubuntu package)
linux-image-5.4.0-58-lowlatency (Ubuntu package)
linux-image-5.4.0-1023-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1025-raspi (Ubuntu package)
linux-image-5.4.0-1028-kvm (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1030-kvm (Ubuntu package)
linux-image-5.4.0-1030-aws (Ubuntu package)
linux-image-5.4.0-1030-oracle (Ubuntu package)
linux-image-5.4.0-1030-gcp (Ubuntu package)
linux-image-5.4.0-1032-aws (Ubuntu package)
linux-image-5.4.0-1032-azure (Ubuntu package)
linux-image-5.4.0-1032-oracle (Ubuntu package)
linux-image-5.4.0-1032-gcp (Ubuntu package)
linux-image-5.4.0-1033-oracle (Ubuntu package)
linux-image-5.4.0-1034-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1053-oem (Ubuntu package)
linux-image-5.8.0-31-lowlatency (Ubuntu package)
linux-image-5.8.0-31-generic-64k (Ubuntu package)
linux-image-5.8.0-31-generic (Ubuntu package)
linux-image-5.8.0-31-generic-lpae (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.8.0-33-lowlatency (Ubuntu package)
linux-image-5.8.0-33-generic-lpae (Ubuntu package)
linux-image-5.8.0-33-generic (Ubuntu package)
linux-image-5.8.0-33-generic-64k (Ubuntu package)
linux-image-5.8.0-1008-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1008-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1010-raspi (Ubuntu package)
linux-image-5.8.0-1010-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1011-oracle (Ubuntu package)
linux-image-5.8.0-1011-kvm (Ubuntu package)
linux-image-5.8.0-1012-gcp (Ubuntu package)
linux-image-5.8.0-1013-oracle (Ubuntu package)
linux-image-5.8.0-1013-kvm (Ubuntu package)
linux-image-5.8.0-1013-azure (Ubuntu package)
linux-image-5.8.0-1014-gcp (Ubuntu package)
linux-image-5.8.0-1014-aws (Ubuntu package)
linux-image-5.8.0-1015-azure (Ubuntu package)
linux-image-5.8.0-1016-aws (Ubuntu package)

Install updates from vendor's website.

linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.129.116, 5.4.0.56.59, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.129.116, 5.4.0.56.59, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.129.116, 5.4.0.56.59, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.129.116, 5.4.0.56.59, 5.4.0.58.61, 5.8.0.31.36, 5.8.0.33.38
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.129.128, 5.4.0.56.59, 5.4.0.58.61, 5.4.0.58.64~18.04.53
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.129.128
linux-image-4.15.0-129-generic (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-4.15.0-129-generic-lpae (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-4.15.0-129-lowlatency (Ubuntu package) - update to 4.15.0-129.132~16.04.1
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1062.51, 5.4.0.1030.14, 5.4.0.1030.27, 5.4.0.1032.29, 5.4.0.1033.16, 5.8.0.1011.11, 5.8.0.1013.13
linux-image-4.15.0-1062-oracle (Ubuntu package) - update to 4.15.0-1062.68~16.04.1
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1062.72
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1077.74, 5.4.0.1023.58, 5.4.0.1025.60
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1077.81, 4.15.0.1091.92, 5.4.0.1030.38, 5.4.0.1032.41, 5.8.0.1012.12, 5.8.0.1014.14
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1077.81
linux-image-4.15.0-1077-gke (Ubuntu package) - update to 4.15.0-1077.82
linux-image-4.15.0-1077-raspi2 (Ubuntu package) - update to 4.15.0-1077.82
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1082.78, 5.4.0.1028.26, 5.4.0.1030.28, 5.8.0.1011.12, 5.8.0.1013.15
linux-image-4.15.0-1082-kvm (Ubuntu package) - update to 4.15.0-1082.84
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1091.85
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1091.92, 5.4.0.1030.18, 5.4.0.1030.38, 5.4.0.1032.20, 5.4.0.1032.41, 5.8.0.1012.12, 5.8.0.1014.14
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1091.93
linux-image-4.15.0-1091-aws (Ubuntu package) - update to 4.15.0-1091.96~16.04.1
linux-image-4.15.0-1091-gcp (Ubuntu package) - update to 4.15.0-1091.104~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1091.109
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1094.97
linux-image-4.15.0-1094-snapdragon (Ubuntu package) - update to 4.15.0-1094.103
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1103.76
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1103.78, 4.15.0.1103.96, 5.4.0.1032.14, 5.4.0.1032.30, 5.4.0.1034.16, 5.4.0.1034.32, 5.8.0.1013.13, 5.8.0.1015.15
linux-image-4.15.0-1103-azure (Ubuntu package) - addressed in versions 4.15.0-1103.114~14.04.1, 4.15.0-1103.114~16.04.1
python2-perf - update to 4.19.90-2102.2.0.0057
python3-perf - update to 4.19.90-2102.2.0.0057
bpftool-debuginfo - update to 4.19.90-2102.2.0.0057
kernel-tools-devel - update to 4.19.90-2102.2.0.0057
kernel-tools-debuginfo - update to 4.19.90-2102.2.0.0057
python2-perf-debuginfo - update to 4.19.90-2102.2.0.0057
kernel-source - update to 4.19.90-2102.2.0.0057
perf - update to 4.19.90-2102.2.0.0057
kernel-devel - update to 4.19.90-2102.2.0.0057
perf-debuginfo - update to 4.19.90-2102.2.0.0057
python3-perf-debuginfo - update to 4.19.90-2102.2.0.0057
kernel - update to 4.19.90-2102.2.0.0057
bpftool - update to 4.19.90-2102.2.0.0057
kernel-debugsource - update to 4.19.90-2102.2.0.0057
kernel-tools - update to 4.19.90-2102.2.0.0057
kernel-debuginfo - update to 4.19.90-2102.2.0.0057
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.56.59, 5.4.0.56.62~18.04.50, 5.4.0.58.61, 5.4.0.58.64~18.04.53
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.4.0.56.59
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.4.0.56.59
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.4.0.56.59
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.4.0.56.59
linux-image-5.4.0-56-lowlatency (Ubuntu package) - update to 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-generic-lpae (Ubuntu package) - update to 5.4.0-56.62~18.04.1
linux-image-5.4.0-56-generic (Ubuntu package) - update to 5.4.0-56.62~18.04.1
linux-image-virtual-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.56.62~18.04.50, 5.4.0.58.64~18.04.53
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.56.62~18.04.50, 5.4.0.58.64~18.04.53
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.56.62~18.04.50, 5.4.0.58.64~18.04.53
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.56.62~18.04.50, 5.4.0.58.64~18.04.53
linux-image-generic-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.56.62~18.04.50, 5.4.0.58.64~18.04.53
linux-image-5.4.0-58-generic (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-58-generic-lpae (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-58-lowlatency (Ubuntu package) - update to 5.4.0-58.64~18.04.1
linux-image-5.4.0-1023-raspi (Ubuntu package) - update to 5.4.0-1023.26~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - addressed in versions 5.4.0.1023.27, 5.4.0.1025.29
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1023.58, 5.4.0.1025.60, 5.8.0.1008.11, 5.8.0.1010.13
linux-image-5.4.0-1025-raspi (Ubuntu package) - update to 5.4.0-1025.28~18.04.1
linux-image-5.4.0-1028-kvm (Ubuntu package) - update to 5.4.0-1028.29
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1030.15, 5.4.0.1030.31, 5.4.0.1032.17, 5.4.0.1032.33, 5.8.0.1014.16, 5.8.0.1016.18
linux-image-5.4.0-1030-kvm (Ubuntu package) - update to 5.4.0-1030.31
linux-image-5.4.0-1030-aws (Ubuntu package) - update to 5.4.0-1030.31~18.04.1
linux-image-5.4.0-1030-oracle (Ubuntu package) - update to 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1030-gcp (Ubuntu package) - update to 5.4.0-1030.32~18.04.1
linux-image-5.4.0-1032-aws (Ubuntu package) - update to 5.4.0-1032.33~18.04.1
linux-image-5.4.0-1032-azure (Ubuntu package) - update to 5.4.0-1032.33~18.04.1
linux-image-5.4.0-1032-oracle (Ubuntu package) - update to 5.4.0-1032.34
linux-image-5.4.0-1032-gcp (Ubuntu package) - update to 5.4.0-1032.34~18.04.1
linux-image-5.4.0-1033-oracle (Ubuntu package) - update to 5.4.0-1033.35
linux-image-5.4.0-1034-azure (Ubuntu package) - update to 5.4.0-1034.35~18.04.1
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.6.0.1053.49, 5.8.0.31.36, 5.8.0.33.38
linux-image-5.6.0-1053-oem (Ubuntu package) - update to 5.6.0-1053.57
linux-image-5.8.0-31-lowlatency (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic-64k (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic (Ubuntu package) - update to 5.8.0-31.33
linux-image-5.8.0-31-generic-lpae (Ubuntu package) - update to 5.8.0-31.33
linux-image-generic-64k (Ubuntu package) - addressed in versions 5.8.0.31.36, 5.8.0.33.38
linux-image-5.8.0-33-lowlatency (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-generic-lpae (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-generic (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-33-generic-64k (Ubuntu package) - update to 5.8.0-33.36
linux-image-5.8.0-1008-raspi-nolpae (Ubuntu package) - update to 5.8.0-1008.11
linux-image-5.8.0-1008-raspi (Ubuntu package) - update to 5.8.0-1008.11
linux-image-raspi-nolpae (Ubuntu package) - addressed in versions 5.8.0.1008.11, 5.8.0.1010.13
linux-image-5.8.0-1010-raspi (Ubuntu package) - update to 5.8.0-1010.13
linux-image-5.8.0-1010-raspi-nolpae (Ubuntu package) - update to 5.8.0-1010.13
linux-image-5.8.0-1011-oracle (Ubuntu package) - update to 5.8.0-1011.11
linux-image-5.8.0-1011-kvm (Ubuntu package) - update to 5.8.0-1011.12
linux-image-5.8.0-1012-gcp (Ubuntu package) - update to 5.8.0-1012.12
linux-image-5.8.0-1013-oracle (Ubuntu package) - update to 5.8.0-1013.13
linux-image-5.8.0-1013-kvm (Ubuntu package) - update to 5.8.0-1013.14
linux-image-5.8.0-1013-azure (Ubuntu package) - update to 5.8.0-1013.14
linux-image-5.8.0-1014-gcp (Ubuntu package) - update to 5.8.0-1014.14
linux-image-5.8.0-1014-aws (Ubuntu package) - update to 5.8.0-1014.15
linux-image-5.8.0-1015-azure (Ubuntu package) - update to 5.8.0-1015.16
linux-image-5.8.0-1016-aws (Ubuntu package) - update to 5.8.0-1016.17

• Exploit #10921 - CVE-2020-0423 (Researching CVE published originally by longterm.io) (November 29, 2024)

• https://source.android.com/security/bulletin/2020-10-01

• Multiple vulnerabilities in Google Android
• Ubuntu update for linux
• Ubuntu update for linux-oem-5.6
• openEuler 20.03 LTS SP1 update for kernel
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux