CVE-2020-27059 (High) detected in baseandroid-10.0.0_r34
Opened this issue · 0 comments
CVE-2020-27059 - High Severity Vulnerability
Vulnerable Library - baseandroid-10.0.0_r34
Android framework classes and services
Library home page: https://android.googlesource.com/platform/frameworks/base
Found in HEAD commit: 63dffabe2f7231360a99be2201b925eaed040fb6
Found in base branch: master
Vulnerable Source Files (1)
/services/core/java/com/android/server/biometrics/AuthenticationClient.java
Vulnerability Details
In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.
Publish Date: 2021-01-11
URL: CVE-2020-27059
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-11.0.0_r28
Release Date: 2020-10-13
Fix Resolution: android-11.0.0_r28
Step up your Open Source Security Game with Mend here