CVE-2019-20610

EPSS 0.15%
Veröffentlicht 24.03.2020 20:15:13
Zuletzt bearbeitet 21.11.2024 04:38:52
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered on Samsung mobile devices with N(7.X) and O(8.X) (Exynos 7570, 7870, 7880, 7885, 8890, 8895, and 9810 chipsets) software. A double-fetch vulnerability in Trustlet allows arbitrary TEE code execution. The Samsung ID is SVE-2019-13910 (April 2019).

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version7.0

   Samsung ≫ Exynos 7570 Version-
   Samsung ≫ Exynos 7870 Version-
   Samsung ≫ Exynos 7880 Version-
   Samsung ≫ Exynos 7885 Version-
   Samsung ≫ Exynos 8890 Version-
   Samsung ≫ Exynos 8895 Version-
   Samsung ≫ Exynos 9810 Version-

Google ≫ Android Version7.1.0

Google ≫ Android Version7.1.1

Google ≫ Android Version7.1.2

Google ≫ Android Version8.0

Google ≫ Android Version8.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.15%	0.322

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

https://security.samsungmobile.com/securityUpdate.smsb

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-20610

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-20610

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-20610

EUVD