Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-11600
CVE-2020-11600:
NixOS vulnerability analysis and mitigation
Overview
An issue was discovered on Samsung mobile devices running Android Q(10.0) software that allows arbitrary code execution in the Fingerprint Trustlet through a memory overwrite vulnerability. This vulnerability was identified with Samsung IDs SVE-2019-16587, SVE-2019-16588, and SVE-2019-16589 in April 2020 (NVD, CVE).
Technical details
The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue. It received a Critical CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v2.0 base score of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), indicating the highest severity level (NVD).
Impact
The vulnerability allows for arbitrary code execution, which could potentially give attackers complete control over the affected device's fingerprint subsystem. Given the critical CVSS scores and the nature of the vulnerability, it poses significant risks to device security and user data protection (NVD).
Mitigation and workarounds
Samsung has addressed this vulnerability through their security update process. Users are advised to apply the latest security patches available for their devices (Samsung Security).
Additional resources
Source: This report was generated using AI
Related NixOS vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management