| Vulnerability Name: | CVE-2020-0306 |
| Assigned: | 2019-10-17 |
| Published: | 2020-09-17 |
| Updated: | 2021-07-21 |
| Summary: | In LLVM, there is a possible ineffective stack cookie placement due to stack frame double reservation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-139666480
|
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
|
| CVSS v2 Severity: | 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-269
|
| References: | Source: MITRE
Type: CNA
CVE-2020-0306
Source: MISC
Type: Vendor Advisory
https://source.android.com/security/bulletin/android-11
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:google:android:11.0:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Vulnerability Name: | CVE-2020-0306 (CCN-188964) |
| Assigned: | 2019-10-17 |
| Published: | 2020-08-25 |
| Updated: | 2020-09-23 |
| Summary: | In LLVM, there is a possible ineffective stack cookie placement due to stack frame double reservation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-139666480
|
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
|
| CVSS v2 Severity: | 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
|
| Vulnerability Type: | CWE-269
|
| Vulnerability Consequences: | Gain Privileges |
| References: | Source: CCN
Type: Google Web site
Android
Source: MITRE
Type: CNA
CVE-2020-0306
Source: XF
Type: UNKNOWN
android-cve20200306-priv-esc(188964)
Source: CCN
Type: Ubuntu CVE Tracker
CVE-2020-0306
Source: CCN
Type: Android Open Source Project
Android 11 Security Release Notes
Source: MISC
Type: Vendor Advisory
https://source.android.com/security/bulletin/android-11
|
| Vulnerable Configuration: | Configuration CCN 1:
cpe:/o:google:android:-:*:*:*:*:*:*:*AND cpe:/o:canonical:ubuntu:16.04::~~lts~~~:*:*:*:*:*OR cpe:/o:canonical:ubuntu:18.04::~~lts~~~:*:*:*:*:*OR cpe:/o:canonical:ubuntu:12.04::~~esm~~~:*:*:*:*:*OR cpe:/o:canonical:ubuntu:14.04::~~esm~~~:*:*:*:*:*OR cpe:/o:canonical:ubuntu:20.04::~~lts~~~:*:*:*:*:*OR cpe:/o:canonical:ubuntu:20.10:*:*:*:*:*:*:*
Denotes that component is vulnerable |
| BACK |