CVE-2020-0142
📋 TL;DR
This vulnerability in Android's NFC stack allows remote information disclosure without user interaction. Attackers can exploit a missing bounds check in the rw_i93_sm_format function to read sensitive memory contents. Only Android 10 devices are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker reads sensitive kernel memory, potentially exposing cryptographic keys, passwords, or other protected data from nearby Android devices.
Likely Case
Information leakage of nearby device memory contents when NFC is enabled, potentially exposing application data or system information.
If Mitigated
With proper patching, no information disclosure occurs; NFC functionality remains secure.
🎯 Exploit Status
Exploitation requires proximity to target device and NFC capability; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2020-06-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2020-06-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update. 2. Install Android Security Patch Level 2020-06-01 or later. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable NFC
androidTurn off NFC functionality to prevent exploitation
Settings > Connected devices > Connection preferences > NFC > Toggle OFF
🧯 If You Can't Patch
- Disable NFC functionality completely on affected devices
- Restrict physical access to devices and implement proximity controls
🔍 How to Verify
Check if Vulnerable:
Check Android version: Settings > About phone > Android version. If version is 10 and security patch level is before 2020-06-01, device is vulnerable.Check Version:
adb shell getprop ro.build.version.release && adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android Security Patch Level is 2020-06-01 or later in Settings > About phone > Android security patch level.📡 Detection & Monitoring
Log Indicators:
- Unusual NFC activity logs in system logs
- Multiple failed NFC handshake attempts
Network Indicators:
- N/A - This is a local NFC vulnerability
SIEM Query:
N/A - Physical proximity attack not detectable via network monitoring