PT-2021-13333 · Google · Android

Published 2021-11-01 · Updated 2022-07-12 · CVE-2021-0799

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-12

Description In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android version Android-12, consider restricting access to the content provider's authorities until a patch is available. As a temporary workaround, review and limit the use of sensitive operations within ActivityThread.java to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ASB-A-197647956

CVE-2021-0799

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/2021-11-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0799 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0799 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-197647956 · Vendor Advisory
• https://t.me/cibsecurity/34082 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/9a4e52fa566169d5dd78d672fa3be048de9b0041 · Note