CVE-2020-0465: Google Android Privilege Escalation Flaw

CVE-2020-0465 Overview

CVE-2020-0465 is an out-of-bounds write vulnerability [CWE-787] in the hid-multitouch.c driver of the Android kernel. The flaw stems from a missing bounds check in various methods that process Human Interface Device (HID) multitouch reports. A malicious USB or Bluetooth HID device can deliver crafted descriptors that trigger the out-of-bounds write, leading to local privilege escalation. Exploitation requires no additional execution privileges and no user interaction. Google addressed the issue in the December 2020 Android Security Bulletin.

Critical Impact
Successful exploitation grants kernel-level privilege escalation through a physically attached or paired HID device, undermining the Android sandbox.

Affected Products

Google Android (Android kernel)
Devices integrating the upstream Linux hid-multitouch driver prior to the December 2020 patch
Android builds without the December 2020 security patch level

Discovery Timeline

2020-12-14 - CVE-2020-0465 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-0465

Vulnerability Analysis

The vulnerability resides in drivers/hid/hid-multitouch.c, the Linux kernel driver that interprets HID reports from multitouch input devices. Several methods within the driver write data into fixed-size buffers based on values supplied by the HID device. Without proper bounds validation, an attacker-controlled report descriptor can cause the driver to write beyond allocated buffer boundaries. The write occurs in kernel memory, enabling corruption of adjacent kernel structures.

The attack vector is physical, meaning the adversary must connect a malicious HID device via USB On-The-Go (OTG) or pair a crafted Bluetooth peripheral. Once connected, the rogue device advertises descriptors that the kernel parses automatically during enumeration. No user approval or unlock state interaction with the device is required to reach the vulnerable code path.

Root Cause

The root cause is a missing bounds check on values derived from untrusted HID report fields. The driver assumes input from HID descriptors falls within expected ranges and indexes into kernel arrays without validating the upper bound. This pattern is characteristic of [CWE-787] Out-of-Bounds Write defects in kernel driver code.

Attack Vector

An attacker with physical access connects a programmable HID device, such as a Raspberry Pi running USB Gadget mode or a Bluetooth LE peripheral. The device emits a crafted multitouch report descriptor with fields engineered to exceed driver buffer bounds. The kernel parses the descriptor during device probe, triggering the out-of-bounds write. Carefully shaped writes can corrupt function pointers or kernel objects to achieve privilege escalation from an unprivileged context. See the Android Security Bulletin December 2020 for upstream patch references.

Detection Methods for CVE-2020-0465

Indicators of Compromise

Unexpected hid-multitouch kernel module faults or oops messages in dmesg or logcat -b kernel
Kernel panics following connection of unfamiliar USB or Bluetooth HID peripherals
Anomalous privilege transitions on Android devices shortly after a peripheral connection event

Detection Strategies

Audit Android build fingerprints to confirm the Security Patch Level is 2020-12-01 or later
Inspect kernel logs for HID driver assertions, slab corruption warnings, or KASAN reports referencing hid-multitouch
Monitor mobile device management (MDM) telemetry for USB and Bluetooth peripheral attachment events on unpatched fleets

Monitoring Recommendations

Enforce MDM policies that block unauthorized USB OTG and Bluetooth HID pairing on managed Android devices
Aggregate Android device patch level reporting and alert on devices below the December 2020 baseline
Correlate peripheral connection events with subsequent process crashes or unexpected root-owned activity

How to Mitigate CVE-2020-0465

Immediate Actions Required

Apply the Android Security Patch Level 2020-12-01 or later on all affected devices
For OEM and AOSP builds, integrate the upstream Linux kernel fix to hid-multitouch.c into device kernels
Disable USB OTG and unmanaged Bluetooth pairing on high-risk or kiosk-mode devices until patched

Patch Information

Google released the fix as part of the Android Security Bulletin December 2020 under Android ID A-162844689. The patch adds the missing bounds checks in the affected methods of hid-multitouch.c. Device manufacturers must propagate the patch through their kernel branches and ship updates to end-user devices.

Workarounds

Restrict physical access to devices and avoid connecting untrusted USB or Bluetooth peripherals
Use MDM controls to deny HID device classes on managed Android endpoints
Decommission or isolate end-of-life Android devices that no longer receive security patches

bash

# Verify the Android Security Patch Level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2020-12-01 or later