PT-2022-10953 · Google · Android

Published 2022-02-01 · Updated 2022-02-17 · CVE-2021-39668

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-11 through Android-12

Description The issue is related to a possible Intent Redirect due to a confused deputy in the onActivityViewReady function of DetailDialog.kt. This could lead to local escalation of privilege, allowing actions to be performed as the System UI without needing additional execution privileges. User interaction is required for exploitation.

Recommendations For Android versions Android-11 through Android-12, consider restricting access to the onActivityViewReady function of DetailDialog.kt to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the affected DetailDialog.kt functionality until the issue is resolved.

Fix

Weakness Enumeration

CWE-610

Related Identifiers

ASB-A-193445603

CVE-2021-39668

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2022-02-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39668 · Security Note
• https://osv.dev/vulnerability/ASB-A-193445603 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39668 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/f84fdf2e6a98b81c7b55517227bd4cb53318d5aa · Note