Vulnerability in Oneplus 7 Pro
CVE-2020-7958
An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution Environment (REE) to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the Trusted Application (TA) supports an extended number of commands beyond what is needed to implement a fingerprint authentication system compatible with Android. An attacker who is in the position to send commands to the TA (for example, the root user) is able to send a sequence of these commands that will result in the TA sending a raw fingerprint image to the REE. This means that the Trusted Execution Environment (TEE) no longer protects identifiable fingerprint data from the REE.
EPSS: 0.006 (44.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Oneplus Oneplus_7_pro
- Oneplus Oneplus_7_pro_firmware
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-7958?
- CVE-2020-7958 is a medium-severity vulnerability in Oneplus 7 Pro. CVSS score: 6.0/10. Published 2020-04-14.
- How severe is CVE-2020-7958?
- Medium severity. CVSS v3 base score is 6.0 out of 10.
- Is CVE-2020-7958 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.