PT-2021-13421 · Google · Android

Published 2021-12-15 · Updated 2021-12-17 · CVE-2021-1016

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version

Description The issue allows an app to gain access to USB without the user's knowledge due to a tapjacking/overlay attack. This could lead to local escalation of privilege, with the attacker needing to execute the exploit with user privileges. User interaction is required for the exploitation to occur.

Recommendations For Android versions prior to the fixed version, consider restricting access to USB permissions to minimize the risk of exploitation until a patch is available. As a temporary workaround, users should be cautious when granting USB access to apps, ensuring they are aware of the permissions being granted.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-1016

Affected Products

Android

References · 3

• https://source.android.com/security/bulletin/pixel/2021-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1016 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1016 · Vendor Advisory