PT-2021-13105 · Google · Android

Published 2021-04-13 · Updated 2022-07-12 · CVE-2021-0428

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android versions Android-10

Description: The issue is related to a missing permission check in the getSimSerialNumber function of TelephonyManager.java. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

Recommendations: For Android version Android-10, consider restricting access to the getSimSerialNumber function of TelephonyManager.java to minimize the risk of exploitation. As a temporary workaround, review and adjust permission settings related to TelephonyManager to prevent unauthorized access to sensitive information.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-173421434

CVE-2021-0428

Affected Products

Android

References · 15

• https://osv.dev/vulnerability/ASB-A-173421434 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-09-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0428 · Security Note
• https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/129cc56868dfc198de41909ff9d6c542a84a4c21 · Note
• https://android.googlesource.com/platform/frameworks/base/+/1c1bc30ce345f770de44b4348420e860d0958534 · Note
• https://android.googlesource.com/platform/frameworks/opt/telephony/+/93d5117cf5f528ec7ed74b4fe2df7ae7e2d207ff · Note
• https://t.me/cvenotify/21982 · Telegram Post
• https://t.me/cvenotify/13376 · Telegram Post
• https://android.googlesource.com/platform/frameworks/opt/telephony/+/9c392805dc4c5d5c9a95a5dec9c7f65130cd8173 · Note
• https://android.googlesource.com/platform/frameworks/opt/telephony/+/640387d310ce6fdfa71f606744eb903bedba57ce · Note
• https://android.googlesource.com/platform/frameworks/base/+/a13fc7f314ac56e75eca09c94db8090f928023ff · Note
• https://android.googlesource.com/platform/frameworks/opt/telephony/+/7dfee2e7c3f762d069b8c606f8591498f109ff3e · Note
• https://android.googlesource.com/platform/frameworks/opt/telephony/+/f587f04d306f2faa9e102d9e2de87a403a48638e · Note
• https://android.googlesource.com/platform/frameworks/base/+/5aba70130d3539fc77cfdfb4b550d8e86acd8a60 · Note