PT-2021-13194 · Google · Android

Published 2021-06-22 · Updated 2021-06-25 · CVE-2021-0547

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android version Android-11

Description: In the onReceive method of NetInitiatedActivity.java, a missing permission check allows an attacker-controlled value to be supplied to a GPS HAL handler. This could lead to local escalation of privilege, resulting in undefined behavior in some HAL implementations without requiring additional execution privileges. User interaction is not needed for exploitation.

Recommendations: For Android version Android-11, apply the necessary patch to fix the missing permission check in NetInitiatedActivity.java to prevent supplying attacker-controlled values to the GPS HAL handler. As a temporary workaround, consider restricting access to the GPS HAL handler until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-0547

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-0547 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0547 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2021-06-01 · Vendor Advisory
• https://t.me/cvenotify/16640 · Telegram Post