CVE-2020-0022 is a potentially dangerous remote code execution vulnerability in Bluetooth. The bug is one of the fixes in the February security updates for Android. The flaw was unearthed and reported by German security researchers from ERNW.
CVE-2020-0022: What Is Known So Far
The German team reported the bug in November, 2019. According to their report, no user interaction is needed to exploit the bug, with the condition that Bluetooth is enabled:
On Android 8.0 to 9.0, a remote attacker within proximity can silently execute arbitrary code with the privileges of the Bluetooth daemon as long as Bluetooth is enabled. No user interaction is required and only the Bluetooth MAC address of the target devices has to be known. For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address. This vulnerability can lead to theft of personal data and could potentially be used to spread malware (Short-Distance Worm).
It should be noted that CVE-2020-0022 can’t be exploited on Android 10 for technical reasons and will only result in a crash of the Bluetooth daemon.
Android versions older than version 8.0 may also be affected but the researchers haven’t evaluated an eventual impact. Any users who believe they are impacted by the vulnerability should switch to wired headphones and make sure their Android devices cannot be discovered in public.
Other Bugs Also Fixed in Android Security Bulletin February 2020
CVE-2020-0022 is just one of the two dozen vulnerabilities fixed in this month’s share of Google updates. Six of these vulnerabilities exist in System components, the Bluetooth one inclusive. Other flaws include two information disclosure bugs and two elevation of privilege bugs affecting Android versions from 8 to 10.
Seven vulnerabilities are located in the Android Framework, three of which allow information disclosure. Other three are of the elevation-of-privilege type, and one is a denial of service issue.
Qualcomm components contain other 10 bugs, four of which are rated as high security risks. However, no further information is provided as the issues involve closed-source components.
Android device users are advised to patch their systems immediately to avoid any exploits. More information is available in Android’s Security Bulletin.
In August 2019, a team of security specialists detected a critical threat that affected Bluetooth-enabled devices. It is known as the KNOB Bluetooth vulnerability that allowed malicious operators to attack target end devices while at the same time stealing sensitive encryption keys during the connection initiation process. The security reports indicated that the issue comes from the technical specifications which were created 20 years ago.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: