PT-2021-13110 · Google · Android

Published 2021-04-01 · Updated 2021-04-16 · CVE-2021-0433

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions 8.1 through 11

Description: The issue allows for a possible bypass of user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is necessary for exploitation.

Recommendations: For Android versions 8.1 through 11, consider disabling the Bluetooth pairing functionality in DeviceChooserActivity.java as a temporary workaround until a patch is available. Restrict access to the DeviceChooserActivity to minimize the risk of exploitation. Avoid using the affected Bluetooth pairing feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ASB-A-171221090

CVE-2021-0433

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2021-04-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-171221090 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0433 · Security Note
• https://t.me/cvenotify/13369 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/8e4928820e972a00342c00cf67e8795a094e6e68 · Note
• https://android.googlesource.com/platform/frameworks/base/+/75419418cfd2f47439d0f65418f4a771cc58d14b · Note