PT-2021-13020 · Google · Android

Published 2021-02-01 · Updated 2021-02-12 · CVE-2021-0339

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android versions Android-8.1 through Android-10

Description: The issue allows a malicious app to remain displayed while a target app is brought to the foreground, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations: For Android versions Android-8.1 through Android-10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

ASB-A-145728687

CVE-2021-0339

Affected Products

Android

References · 10

• https://source.android.com/security/bulletin/2021-02-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0339 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0339 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-145728687 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/36bcc77337814d4d36e2b10eb062ac417d91611e · Note
• https://android.googlesource.com/platform/frameworks/base/+/6de34f8ee714691dbc3c089245bf832006826ebe · Note
• https://android.googlesource.com/platform/frameworks/base/+/8669ef385780b8415412407deec85539a1e7db98 · Note
• https://android.googlesource.com/platform/frameworks/base/+/4236b3e88fe444e2fbec7aa564fccf8b57c071dd · Note
• https://android.googlesource.com/platform/frameworks/base/+/ee11625bb707c3512d4e44a35cc85b0bd14a2478 · Note
• https://t.me/cibsecurity/23382 · Telegram Post