PT-2021-13019 · Google · Android

Published 2021-02-01 · Updated 2021-04-01 · CVE-2021-0338

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-11

Description: In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

Recommendations: For Android versions Android-10 through Android-11, consider restricting access to SystemSettingsValidators until a patch is available. As a temporary workaround, consider disabling the UI settings functionality to minimize the risk of exploitation. Avoid using the affected UI settings until the issue is resolved.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ASB-A-156260178

CVE-2021-0338

Affected Products

Android

References · 9

• https://source.android.com/security/bulletin/2021-02-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-156260178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0338 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0338 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/459f6cbe7537b1ba0b88b96c44099bc897c1bcc8 · Note
• https://t.me/cibsecurity/23363 · Telegram Post
• https://source.android.com/security/bulletin/2021-04-01 · Note
• https://t.me/cvenotify/9731 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/edeb081ad8b22b4a32ff90610f9f06182025e41c · Note