What’s Vulnerable › Vulnerabilities
CVE-2020-0022
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-13 · updated 2026-06-17
- Weakness: CWE-682
Description
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715
Affected products
- Android: 8.0, 8.1, 9.0, 10.0
- Huawei Honor 8A Firmware: before 9.1.0.291\(c185e3r4p1\) — fixed in 9.1.0.291\(c185e3r4p1\)
- Huawei Honor 8X Firmware: before 10.0.0.183\(c185e2r6p1\) — fixed in 10.0.0.183\(c185e2r6p1\)
- Huawei Honor View 20 Firmware: before 10.0.0.195\(c636e3r4p3\) — fixed in 10.0.0.195\(c636e3r4p3\)
- HUAWEI Mate 20: before 10.0.0.195\(c00e74r3p8\) — fixed in 10.0.0.195\(c00e74r3p8\)
- HUAWEI Mate 20 Pro: before 10.0.0.196\(c185e7r2p4\) — fixed in 10.0.0.196\(c185e7r2p4\)
- Huawei Mate 20 X: before 10.0.0.195\(c00e74r2p8\) — fixed in 10.0.0.195\(c00e74r2p8\)
- Huawei Mate 30 5G Firmware: before 10.0.0.203\(c00e202r7p2\) — fixed in 10.0.0.203\(c00e202r7p2\)
- HUAWEI Mate 30: before 10.0.0.203\(c00e202r7p2\) — fixed in 10.0.0.203\(c00e202r7p2\)
- Huawei Mate 30 Pro 5G Firmware: before 10.0.0.203\(c00e202r7p2\) — fixed in 10.0.0.203\(c00e202r7p2\)
- HUAWEI Mate 30 Pro: before 10.0.0.203\(c00e202r7p2\) — fixed in 10.0.0.203\(c00e202r7p2\)
- Huawei Nova 3 Firmware: before 9.1.0.338\(c00e333r1p1t8\) — fixed in 9.1.0.338\(c00e333r1p1t8\)
- Huawei Nova Lite 3 Firmware: before 9.1.0.322\(c635e8r2p2\) — fixed in 9.1.0.322\(c635e8r2p2\)
- P20: before 10.0.0.162\(c00e156r1p4\) — fixed in 10.0.0.162\(c00e156r1p4\)
- Huawei P20 Pro Firmware: before 10.0.0.162\(c00e156r1p4\) — fixed in 10.0.0.162\(c00e156r1p4\)
- HUAWEI P30: before 10.0.0.190\(c432e22r2p5\) — fixed in 10.0.0.190\(c432e22r2p5\)
- HUAWEI P30 Pro: before 10.0.0.195\(c00e85r2p8\) — fixed in 10.0.0.195\(c00e85r2p8\)
- Huawei P Smart 2019 Firmware: before 10.0.0.180\(c185e3r4p1\) — fixed in 10.0.0.180\(c185e3r4p1\)
- Huawei P Smart Firmware: before 9.1.0.193\(c605e6r1p5t8\) — fixed in 9.1.0.193\(c605e6r1p5t8\)
- Huawei Y6 2019 Firmware: before 9.1.0.290\(c185e5r4p1\) — fixed in 9.1.0.290\(c185e5r4p1\)
- Huawei Y6 Pro 2019 Firmware: before 9.1.0.290\(c636e5r3p1\) — fixed in 9.1.0.290\(c636e5r3p1\)
- HUAWEI Y9 2019: before 9.1.0.264\(c185e2r5p1t8\) — fixed in 9.1.0.264\(c185e2r5p1t8\)
How to fix
Upgrade to a fixed version: Huawei Honor 8A Firmware 9.1.0.291\(c185e3r4p1\); Huawei Honor 8X Firmware 10.0.0.183\(c185e2r6p1\); Huawei Honor View 20 Firmware 10.0.0.195\(c636e3r4p3\); HUAWEI Mate 20 10.0.0.195\(c00e74r3p8\); HUAWEI Mate 20 Pro 10.0.0.196\(c185e7r2p4\); Huawei Mate 20 X 10.0.0.195\(c00e74r2p8\); Huawei Mate 30 5G Firmware 10.0.0.203\(c00e202r7p2\); HUAWEI Mate 30 10.0.0.203\(c00e202r7p2\); Huawei Mate 30 Pro 5G Firmware 10.0.0.203\(c00e202r7p2\); HUAWEI Mate 30 Pro 10.0.0.203\(c00e202r7p2\); Huawei Nova 3 Firmware 9.1.0.338\(c00e333r1p1t8\); Huawei Nova Lite 3 Firmware 9.1.0.322\(c635e8r2p2\). Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/156891/Android-Bluetooth-Remote-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/Feb/10
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-03-smartphone-en
- https://source.android.com/security/bulletin/2020-02-01
- http://packetstormsecurity.com/files/156891/Android-Bluetooth-Remote-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/Feb/10
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-03-smartphone-en
- https://source.android.com/security/bulletin/2020-02-01
Get alerted when CVE-2020-0022 or the next vulnerability affects your stack