Rakuten Devices Android Verified Boot RCE Vulnerability CVE-2020-30733

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2020-30733 Vulnerability Name: Code Execution Vulnerability in the Boot Phase of the Android Verified Boot Mechanism Vulnerability Description: A exploitable vulnerability exists in certain smartphones equipped with Android Verified Boot (AVB), allowing attackers to execute arbitrary code during the device boot phase. This vulnerability stems from a flaw in the firmware supply chain verification within the AVB mechanism. Affected Phase: Device boot phase (Boot phase) Attack Vector: By tampering with system images or firmware to bypass AVB verification, malicious code is injected during startup. Scope of Impact Affected Devices: - Rakuten Mini series (all versions) - Rakuten Hand series (all versions) - Rakuten BIG series (all versions) Affected System Versions: - Android 9.0 (Pie) and earlier versions - Specific affected firmware versions: - Base Image 6.0 - Base Image 6.0 (duplicate entry, potentially for different device models) Remediation Official Patch Status: Patch released (marked as [Fix]) Remediation Method: - Update device firmware to the latest version to include the patch fixing this vulnerability. - Users are advised to check for and install system updates via official channels (e.g., the Rakuten Mobile official website). Temporary Mitigation Measures: - Avoid installing system images or firmware from unofficial sources. - Enable the device's "Secure Boot" feature (if available). - Regularly back up important data to prevent loss in case the device is maliciously tampered with. POC Code or Exploit Code No specific POC code or exploit code is provided in the page. It only mentions that the vulnerability can be exploited by tampering with the firmware supply chain, but no actual exploit scripts or tools are given. --- > Note: This vulnerability was jointly disclosed by JPCERT/CC and Rakuten Mobile. Affected users are strongly advised to update their device firmware as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

Rakuten Devices Android Verified Boot RCE Vulnerability CVE-2020-30733