PT-2021-13213 · Google · Android

Published 2021-06-22 · Updated 2021-06-24 · CVE-2021-0570

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions Android-11

Description: The issue is related to a possible permission bypass due to an unsafe PendingIntent in the sendBugreportNotification function of BugreportProgressService.java. This could lead to local escalation of privilege, requiring User execution privileges. No user interaction is needed for exploitation.

Recommendations: For Android version Android-11, consider restricting the use of the PendingIntent in the BugreportProgressService.java until a patch is available. As a temporary workaround, review and limit the permissions associated with the BugreportProgressService to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-0570

Affected Products

Android

References · 3

• https://osv.dev/vulnerability/CVE-2021-0570 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2021-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0570 · Security Note