CVE-2020-0001

Description

In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-140055304

CVSS Version 3.1

nvd

CVE ID: CVE-2020-0001
Base Score: 7.8
Base Severity: HIGH
Vector String:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1.8

CVSS Version 2.0

nvd

CVE ID: CVE-2020-0001
Base Score: 7.2
Base Severity: HIGH
Vector String:AV:L/AC:L/Au:N/C:C/I:C/A:C

Proof Of Concept

Zachinio

POC to run system component in an untrusted-app process

Refrence: GitHub

Refrence: NVD