PT-2021-3655 · Google · Android

Published 2021-06-01 · Updated 2021-06-23 · CVE-2021-0517

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-11

Description The issue is related to a logic error in the updateCapabilities function of ConnectivityService.java, which can lead to incorrect network state determination. This could result in networking tasks being biased to occur on non-VPN networks, potentially allowing a remote attacker to disclose confidential information without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android version Android-11, consider restricting access to the updateCapabilities function of ConnectivityService.java to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and adjust network settings to ensure that sensitive tasks are routed through VPN networks when necessary.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-670

Related Identifiers

ASB-A-179053823

BDU:2021-03881

CVE-2021-0517

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2021-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-179053823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0517 · Security Note
• https://bdu.fstec.ru/vul/2021-03881 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/5b90ebaf4d9edefcd9648b46cd0226f882169476 · Note
• https://vuldb.com/?id.177309 · Note