PT-2021-2465 · Google · Android Kernel

Jack Tang + 1 · Published 2021-03-01 · Updated 2021-03-15 · CVE-2021-0457

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android kernel

Description The issue is related to a heap buffer overflow in the FingerTipS touch screen driver, which could lead to a local escalation of privilege. This requires System execution privileges and does not need user interaction for exploitation.

Recommendations For Android kernel, consider applying a patch or fix to address the heap buffer overflow issue in the FingerTipS touch screen driver as soon as one becomes available. As a temporary workaround, restricting access to the fts driver test write function may help minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-01832

CVE-2021-0457

ZDI-21-279

Affected Products

Android Kernel

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-279 · Security Note
• https://source.android.com/security/bulletin/pixel/2021-03-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01832 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0457 · Security Note
• https://t.me/cvenotify/11263 · Telegram Post
• https://t.me/cibsecurity/24709 · Telegram Post