CVE-2020-0440
📋 TL;DR
This vulnerability allows local attackers to create trusted virtual displays without proper permission checks in Android's DisplayManagerService. It enables local privilege escalation on Android 11 devices, potentially allowing malicious apps to gain elevated system privileges. Only Android 11 devices are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise where attacker gains full system privileges, can access sensitive data, install persistent malware, or disable security controls.
Likely Case
Malicious app gains elevated privileges to access other apps' data, modify system settings, or perform unauthorized actions without user knowledge.
If Mitigated
Attack fails due to proper permission enforcement or device not running vulnerable Android version.
🎯 Exploit Status
Requires local app installation or physical access. No user interaction needed once exploited.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2020-12-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/2020-12-01
Restart Required: Yes
Instructions:
1. Check Android version (Settings > About phone > Android version). 2. Check security patch level (Settings > About phone > Android security patch level). 3. If on Android 11 with patch level before 2020-12-01, install system update. 4. Reboot device after update.
🔧 Temporary Workarounds
Restrict app installations
androidOnly install apps from trusted sources like Google Play Store and disable unknown sources installation.
Settings > Security > Install unknown apps > Disable for all apps
🧯 If You Can't Patch
- Upgrade to Android 12 or later if device supports it
- Use mobile device management (MDM) to restrict app installations and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Android version is 11 and security patch level is before 2020-12-01 in Settings > About phoneCheck Version:
adb shell getprop ro.build.version.release && adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level is 2020-12-01 or later in Settings > About phone > Android security patch level📡 Detection & Monitoring
Log Indicators:
- Unusual virtual display creation events in system logs
- Permission denial logs for display management operations
Network Indicators:
- None - this is a local exploit
SIEM Query:
Look for Android system logs containing 'DisplayManagerService' and 'createVirtualDisplay' with suspicious caller UIDs