PT-2022-10957 · Google · Android

Published 2022-02-01 · Updated 2022-02-18 · CVE-2021-39671

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-12

Description In code generated by aidl const expressions.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android version Android-12, consider updating to a newer version that contains a fix for this issue, as no specific workaround is provided for this version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ASB-A-206718630

CVE-2021-39671

Affected Products

Android

References · 8

• https://source.android.com/security/bulletin/2022-02-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-206718630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39671 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39671 · Vendor Advisory
• https://android.googlesource.com/platform/system/tools/aidl/+/dd0d78f0ead984881caee291751226001f92587e · Note
• https://t.me/cibsecurity/37343 · Telegram Post
• https://t.me/cvenotify/26939 · Telegram Post
• https://android.googlesource.com/platform/system/tools/aidl/+/3f4f24f1fc01aabae8253eb041c6cb236e54402b · Note