PT-2021-13230 · Google · Android

Published 2021-07-01 · Updated 2022-07-12 · CVE-2021-0588

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android versions 8.1 through 9

Description: The issue is related to a missing permission check in the processInboundMessage function of MceStateMachine.java, which could lead to local information disclosure. This disclosure is possible through SMS and does not require any additional execution privileges or user interaction.

Recommendations: For Android versions 8.1 through 9, consider restricting access to sensitive information until a patch is available. As a temporary workaround, review and enforce strict permission checks for SMS-related functions to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ASB-A-177238342

CVE-2021-0588

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-0588 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0588 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-177238342 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Bluetooth/+/bbf60925044c9ea7613c4264dea20c6c12246118 · Note