PT-2022-10956 · Google · Android

Published 2022-05-01 · Updated 2023-08-08 · CVE-2021-39670

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-12 through Android-12L

Description In the setStream method of WallpaperManager.java, there is a possible way to cause a permanent denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android versions Android-12 through Android-12L, consider disabling the setStream method of WallpaperManager.java until a patch is available to prevent potential denial of service attacks.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ASB-A-204087139

CVE-2021-39670

Affected Products

Android

References · 8

• 🔥 https://github.com/Supersonic/Wallbreak · Exploit
• https://osv.dev/vulnerability/ASB-A-204087139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39670 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39670 · Vendor Advisory
• https://source.android.com/security/bulletin/2022-05-01 · Vendor Advisory
• https://t.me/cvenotify/30356 · Telegram Post
• https://t.me/cibsecurity/42280 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/b1b01433f5b8dc0702c0e1abde5f7b86b708a849 · Note