High severity · published Apr 22, 2022
CVE-2020-14123
There is a pointer double free vulnerability in Some MIUI Services
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Miui · MI
12.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14123
Vendor Advisory
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=134
More from Miui
8.8
CVE-2020-14120
Some Xiaomi models have a vulnerability in a certain application
7.5
CVE-2020-14127
A denial of service vulnerability exists in some Xiaomi models of phones
7.5
CVE-2020-14125
A denial of service vulnerability exists in some Xiaomi models of phones
5.5
CVE-2020-14122
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user…
5.5
CVE-2020-14105
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15