CVE-2020-0009

MEDIUM

Android - Incorrect Default Permissions in ashmem.c

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-0009. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit demonstrates two methods to bypass read-only restrictions on Android's ashmem driver. The first method uses remap_file_pages() to gain write access via mprotect(), while the second abuses ASHMEM_UNPIN to zero out memory pages.

Description

In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdosandroid
https://www.exploit-db.com/exploits/47921

This exploit demonstrates two methods to bypass read-only restrictions on Android's ashmem driver. The first method uses remap_file_pages() to gain write access via mprotect(), while the second abuses ASHMEM_UNPIN to zero out memory pages.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Android ashmem driver (affects various versions, including AOSP master)
No auth needed
Prerequisites: Access to the target Android device or emulator · Ability to execute arbitrary code on the device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2020-01-01
Patch, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html

Scores

CVSS v3 5.5
EPSS 0.0069
EPSS Percentile 47.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-276
Status published
Products (2)
debian/debian_linux 8.0
google/android
Published Jan 08, 2020
Tracked Since Feb 18, 2026