CVE-2020-0032: Google Android RCE Vulnerability

CVE-2020-0032 Overview

CVE-2020-0032 is a heap buffer overflow vulnerability in the ih264d_release_display_bufs function within ih264d_utils.c, a component of the Android H.264 video decoder library. The flaw causes an out-of-bounds write on the heap when processing crafted H.264 video content. Successful exploitation can result in remote code execution within the media decoder context without requiring additional execution privileges. User interaction is required, typically by opening a malicious media file or visiting a page that triggers media parsing. The vulnerability affects Android 8.0, 8.1, 9, and 10. Google tracks this issue as Android ID A-145364230 and addressed it in the Android Security Bulletin March 2020.

Critical Impact

Attackers can achieve remote code execution on affected Android devices by delivering a malicious H.264 media file that triggers the heap overflow in the media decoder.

Affected Products

• Google Android 8.0
• Google Android 8.1
• Google Android 9
• Google Android 10

Discovery Timeline

• 2020-03-10 - CVE-2020-0032 published to the National Vulnerability Database
• 2020-03-01 - Google releases fix in the Android Security Bulletin
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-0032

Vulnerability Analysis

The vulnerability resides in ih264d_release_display_bufs, a routine in Android's bundled H.264 decoder (libavc) responsible for releasing display buffers after decoded frames are consumed. During buffer management, the function performs a write operation that exceeds the boundaries of a heap-allocated structure, corrupting adjacent heap memory.

The weakness is classified as [CWE-787] Out-of-Bounds Write. The decoder runs inside the mediacodec or mediaserver process when handling video playback, which historically has provided attackers with a privileged execution surface on Android. An attacker who controls the structure of the H.264 bitstream can shape adjacent heap chunks and hijack control flow.

Root Cause

The root cause is improper validation of buffer indices or counters used when iterating display buffers in ih264d_release_display_bufs. The function writes beyond the allocated bounds of a tracking array on the heap. Because the decoder relies on values derived from untrusted bitstream headers, a malformed stream can drive the loop or index calculation outside its intended range.

Attack Vector

Exploitation requires the victim to render attacker-controlled H.264 content. Delivery channels include MMS messages, instant messaging attachments, drive-by media on web pages, malicious applications that pass crafted streams to the platform decoder, or files received over Bluetooth. Once the malformed stream reaches the H.264 decoder, the out-of-bounds write executes inside the media process and can be chained with heap-grooming techniques to gain code execution. The EPSS score of 1.765% reflects observed interest in mobile media-parser flaws of this class.

No verified public proof-of-concept code is available for this CVE. Technical details are summarized in the vendor advisory and AOSP source history for external/libavc.

Detection Methods for CVE-2020-0032

Indicators of Compromise

• Unexpected crashes or tombstone files in /data/tombstones/ referencing libstagefright, mediaserver, mediacodec, or libavc with SIGSEGV signals during H.264 playback.
• Repeated abnormal terminations of the media.codec or media.extractor services after receiving messaging or browser content.
• Inbound H.264 (.mp4, .3gp, .avc) files with malformed SPS, PPS, or slice headers identified by media scanning tools.

Detection Strategies

• Inspect Android device build fingerprints and security patch level to identify devices below the 2020-03-01 patch level still running Android 8.0 through 10.
• Monitor mobile device management (MDM) telemetry for OS versions and patch levels that remain vulnerable.
• Apply network or email content inspection to flag suspicious H.264 media delivered through messaging gateways.

Monitoring Recommendations

• Forward Android logcat and crash reporter data from managed fleets into a central analytics platform to identify recurring media decoder faults.
• Track Google Play Protect and vendor OEM advisories for follow-on fixes in the H.264 decoder stack.
• Alert on repeated process death of media services correlated with message or browser activity on a single device.

How to Mitigate CVE-2020-0032

Immediate Actions Required

• Apply the March 2020 Android security patch level (2020-03-01) or later to all devices running Android 8.0, 8.1, 9, or 10.
• Replace or retire devices that no longer receive vendor security updates for the affected Android versions.
• Restrict installation of untrusted applications and limit auto-rendering of media in messaging clients until patches are deployed.

Patch Information

Google published the fix in the Android Security Bulletin March 2020 under Android ID A-145364230. OEMs integrated the corrected ih264d_release_display_bufs logic into device images shipped at security patch level 2020-03-01 and later. Devices receiving monthly updates should report a patch level equal to or greater than 2020-03-01 in Settings.

Workarounds

• Disable automatic retrieval of MMS messages in the default messaging application to prevent silent media parsing.
• Avoid opening H.264 video files received from untrusted senders until the device patch level is current.
• Use enterprise mobility management policies to enforce minimum Android security patch levels for corporate access.

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output: 2020-03-01 or later

# Check the running Android version
adb shell getprop ro.build.version.release