CVE-2020-0114
HIGHAndroid 10 - Local Privilege Escalation via KeyguardSliceProvider PendingIntent
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-0114. PoCs published by tea9.
AI-analyzed exploit summary This PoC exploits CVE-2020-0114, a vulnerability in Android's SystemUI component, by manipulating PendingIntents in Slice objects to achieve privilege escalation. The exploit leverages the 'bind_slice' call to retrieve a Slice and then sends a malicious Intent via a PendingIntent to execute privileged actions.
Description
In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147606347
Exploits (1)
This PoC exploits CVE-2020-0114, a vulnerability in Android's SystemUI component, by manipulating PendingIntents in Slice objects to achieve privilege escalation. The exploit leverages the 'bind_slice' call to retrieve a Slice and then sends a malicious Intent via a PendingIntent to execute privileged actions.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H