PT-2021-13242 · Google · Android

Published 2021-07-01 · Updated 2021-12-17 · CVE-2021-0601

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android versions Android-8.1 through Android-11

Description: The issue is related to a possible out of bounds write due to a double free in the encodeFrames function of avc enc fuzzer.cpp. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations: For Android versions Android-8.1 through Android-11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Double Free

Weakness Enumeration

CWE-787

CWE-415

Related Identifiers

ASB-A-180643802

CVE-2021-0601

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/2021-07-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0601 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0601 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-180643802 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/4994 · Telegram Post
• https://android.googlesource.com/platform/external/libavc/+/986b1ff02fbf8551e92e6ba9cf64d5fca47957af · Note