PT-2021-13374 · Google · Android

Published 2021-12-01 · Updated 2021-12-17 · CVE-2021-0963

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Android versions 9 through 12

Description The issue concerns a possible tapjacking/overlay attack in the KeyChainActivity.java file. This could allow an app certificate stored in the keychain to be used, potentially leading to local escalation of privilege without requiring additional execution privileges. User interaction is necessary for exploitation.

Recommendations For Android versions 9 through 12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ASB-A-199754277

CVE-2021-0963

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/2021-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-199754277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0963 · Security Note