CVE-2020-8899
published 2020-05-06CVE-2020-8899: There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.71%
92.1th percentile
There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| samsung | android_os | — | — |
| samsung | android_os | — | — |
| samsung | android_os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is triggered via a specially crafted MMS message containing a malicious .qmg image, processed as a thumbnail — no user interaction required (zero-click). Detection should focus on anomalous MMS traffic delivering .qmg image payloads to Samsung Galaxy devices. ↗
- →The vulnerable component is the Quram qmg library (image codec) on Samsung Android OS versions O (8.x), P (9.0), and Q (10.0). Detection should target heap-based buffer overflow exploitation within this library triggered by inbound MMS. ↗
- ·Affected Samsung Android OS versions are limited to O (8.x), P (9.0), and Q (10.0). Devices patched with Samsung's May 2020 security update are not vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6qjj-3q9g-g44p: There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8
ghsa_unreviewed·2022-05-24
CVE-2020-8899 [HIGH] CWE-122 GHSA-6qjj-3q9g-g44p: There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8
There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.
Project0
MMS Exploit Part 5: Defeating Android ASLR, Getting RCE - Project Zero
project_zero·2020-08-01
CVE-2020-8899 MMS Exploit Part 5: Defeating Android ASLR, Getting RCE - Project Zero
Posted by Mateusz Jurczyk, Project Zero
This post is the fifth and final of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. Previous posts are linked below:
-
MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface
-
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
-
MMS Exploit Part 3: Constructing the Memory Corruption Primitives
-
MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
-
[this post]
Furthermore, with this last post, I have uploaded the source code of the MMS exploit to GitHub and the bug tracker. I hope it will serve as a useful reference while reading this blog, a
Project0
MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface - Project Zero
project_zero·2020-07-01·CVSS 10.0
CVE-2020-8899 [CRITICAL] MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface - Project Zero
Posted by Mateusz Jurczyk, Project Zero
This post is the first of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.
-
[this post]
-
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
-
MMS Exploit Part 3: Constructing the Memory Corruption Primitives
-
MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
-
MMS Exploit Part 5: Defeating Android ASLR, Getting RCE
##
Introduction
In January 2020, I reported a large volume of crashes in a custom Samsung codec called "Qmage", present in all Samsung phones since late 2014 (Android v
No detection rules found.
No public exploits indexed.
http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2002https://security.samsungmobile.com/securityUpdate.smsbhttps://www.kb.cert.org/vuls/id/366027http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2002https://security.samsungmobile.com/securityUpdate.smsbhttps://www.kb.cert.org/vuls/id/366027
2020-05-06
Published