CVE-2020-0140
📋 TL;DR
This vulnerability in Android's NFC stack allows remote information disclosure without user interaction. Attackers can exploit a missing bounds check in the rw_i93_sm_detect_ndef function to read memory contents from affected devices. Only Android 10 devices are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker reads sensitive memory contents including passwords, encryption keys, or other application data from device memory
Likely Case
Information leakage of nearby memory contents, potentially exposing device identifiers or application data
If Mitigated
No impact if patched or if device doesn't use NFC functionality
🎯 Exploit Status
Requires physical proximity to target device with NFC capability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2020-06-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2020-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update
2. Install Android Security Patch Level 2020-06-01 or later
3. Reboot device after installation
🔧 Temporary Workarounds
Disable NFC
androidTurn off NFC functionality to prevent exploitation
Settings > Connected devices > Connection preferences > NFC > Toggle OFF
🧯 If You Can't Patch
- Disable NFC functionality completely
- Restrict physical access to devices and implement physical security controls
🔍 How to Verify
Check if Vulnerable:
Check Android version: Settings > About phone > Android version = 10 AND Security patch level earlier than 2020-06-01Check Version:
adb shell getprop ro.build.version.release && adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Security patch level is 2020-06-01 or later in Settings > About phone📡 Detection & Monitoring
Log Indicators:
- Unusual NFC activity logs
- System crashes in NFC service
Network Indicators:
- N/A - Local exploitation only
SIEM Query:
N/A - No network-based indicators