Google Android keyboard.c kbd_keycode out-of-bounds write

Summaryinfo

A vulnerability was found in Google Android. It has been declared as critical. Impacted is the function kbd_keycode of the file keyboard.c. The manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2020-0431. The attack is only possible with local access. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as critical has been found in Google Android (Smartphone Operating System) (version now known). Affected is the function kbd_keycode of the file keyboard.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459

The weakness was released 09/17/2020 (Website). The advisory is shared for download at source.android.com. This vulnerability is traded as CVE-2020-0431 since 10/17/2019. The attack needs to be approached locally. Required for exploitation is a authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/10/2025). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability scanner Nessus provides a plugin with the ID 246841 (Linux Distros Unpatched Vulnerability : CVE-2020-0431), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (246841). Entries connected to this vulnerability are available at VDB-161473, VDB-161486, VDB-161492 and VDB-161493. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion