CVE-2019-20607

An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory, and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019).

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://security.samsungmobile.com/securityUpdate.smsb	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:google:android:7.0:::::::*
	cpe:2.3:o:google:android:7.1.0:::::::*
	cpe:2.3:o:google:android:7.1.1:::::::*
	cpe:2.3:o:google:android:7.1.2:::::::*
	cpe:2.3:o:google:android:8.0:::::::*
	cpe:2.3:o:google:android:8.1:::::::*
	cpe:2.3:o:google:android:9.0:::::::*

OR	cpe:2.3:h:qualcomm:msm8996:-:::::::*
	cpe:2.3:h:qualcomm:msm8998:-:::::::*
	cpe:2.3:h:samsung:exynos_7420:-:::::::*
	cpe:2.3:h:samsung:exynos_7870:-:::::::*
	cpe:2.3:h:samsung:exynos_8890:-:::::::*
	cpe:2.3:h:samsung:exynos_8895:-:::::::*

History

No history.

Information

Published : 2020-03-24 20:15

Updated : 2024-02-28 17:47

NVD link : CVE-2019-20607

Mitre link : CVE-2019-20607

CVE.ORG link : CVE-2019-20607

JSON object : View

Products Affected

samsung

exynos_8890
exynos_7870
exynos_8895
exynos_7420

qualcomm

msm8996
msm8998

google

android

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-20607", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-03-24T20:15:13.553", "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory, and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en dispositivos m\u00f3viles Samsung con versiones de software N(7.x), O(8.x) y P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890 y Exynos8895). Un desbordamiento de pila (heap) en el keymaster Trustlet permite a atacantes escribir en la memoria TEE y lograr una ejecuci\u00f3n de c\u00f3digo arbitrario. El ID de Samsung es SVE-2019-14126 (Mayo de 2019)."}], "lastModified": "2020-03-30T14:26:51.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"}, {"criteria": "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC30B2A2-9674-4052-B402-20348E50F9E8"}, {"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"}, {"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"}, {"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"}, {"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"}, {"criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:msm8996:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8AAB0FCA-8F94-4FB1-ACCC-02E0222BAE49"}, {"criteria": "cpe:2.3:h:qualcomm:msm8998:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4796F9BD-61B3-45ED-B5E3-B061887285E2"}, {"criteria": "cpe:2.3:h:samsung:exynos_7420:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F0280CE1-C8A6-4317-B583-DDF5C6AA2293"}, {"criteria": "cpe:2.3:h:samsung:exynos_7870:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E73DD2A-67A6-4C19-A2BB-E1F5C44FCC90"}, {"criteria": "cpe:2.3:h:samsung:exynos_8890:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "914FF28A-6B33-4FC5-963D-E576967A001C"}, {"criteria": "cpe:2.3:h:samsung:exynos_8895:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B8E735C6-FF25-4D8C-ACA0-D92DD8CD3F4E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}