#VU51057 Improper Validation of Array Index in Google Android - CVE-2020-11308
Published: March 2, 2021
Vulnerability identifier: #VU51057
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-11308
CWE-ID: CWE-129
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Google Android
Google Android
Software vendor:
Google
Description
The vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to boundary error in bootloader in Qualcomm chipsets when trying to convert ASCII string to Unicode string if the actual size is more than required. An attacker with physical access to the device can trigger buffer overflow during the boot process of the device and gain unauthorized access to the system.
Remediation
Install updates from vendor's website.