PT-2021-13048 · Google · Android

Published 2021-03-10 · Updated 2023-08-08 · CVE-2021-0369

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android version Android-11

Description: The issue is caused by a logic error in the code of CrossProfileAppsServiceImpl.java, which can lead to an application's INTERACT ACROSS PROFILES grant state not displaying properly in the setting UI. This could result in local escalation of privilege with no additional execution privileges needed. User interaction is required for exploitation.

Recommendations: For Android version Android-11, update to a version that includes the fix for the logic error in CrossProfileAppsServiceImpl.java to prevent local escalation of privilege. As a temporary workaround, consider restricting user interaction with the affected setting UI until a patch is available.

Fix

Related Identifiers

CVE-2021-0369

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2021-0369 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2021-03-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0369 · Security Note
• https://t.me/cvenotify/11106 · Telegram Post