CVE-2020-14123 Use after free in MIUI
A double-free vulnerability in MIUI Services allows attackers to crash modules and potentially escalate privileges through malicious operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14123?
CVE-2020-14123 is a high-severity use after free vulnerability in MIUI, published on 22 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.
Weakness: CWE-415
Which versions are affected by CVE-2020-14123?
It affects 1 product.
Products include Mi Miui.
How do I fix CVE-2020-14123?
No fix has been published for CVE-2020-14123 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-14123 being exploited?
There is no known exploitation of CVE-2020-14123 in the wild and no public exploit code.
Other vulnerabilities in MIUI
Sources
Also known as GHSA-j77r-52jv-wg32.