PT-2021-13189 · Google · Android

Published 2021-06-22 · Updated 2022-07-12 · CVE-2021-0542

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android versions Android-11

Description: The issue is related to a missing permission check in the updateNotification function of BeamTransferManager.java. This could lead to local information disclosure of paired Bluetooth addresses without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations: For Android version Android-11, update to a version that includes the fix for the missing permission check in BeamTransferManager.java. As a temporary workaround, consider restricting access to the updateNotification function until a patch is available.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-0542

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-0542 · Security Note
• https://source.android.com/security/bulletin/pixel/2021-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0542 · Vendor Advisory
• https://t.me/cvenotify/16645 · Telegram Post