PT-2022-11070 · Google · Android

Published 2022-04-01 · Updated 2026-01-30 · CVE-2021-39794

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-11 through Android-12L

Description The issue is related to a missing permission check in the broadcastPortInfo of AdbService.java. This could allow apps to run code as the shell user if wireless debugging is enabled, leading to local escalation of privilege with no additional execution privileges needed. User interaction is required for exploitation.

Recommendations For Android versions Android-11 through Android-12L, consider disabling wireless debugging until a patch is available to prevent potential exploitation. As a temporary workaround, restrict the use of AdbService.java to minimize the risk of escalation of privilege.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ASB-A-205836329

CVE-2021-39794

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2022-04-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39794 · Security Note
• https://osv.dev/vulnerability/ASB-A-205836329 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39794 · Vendor Advisory
• https://twitter.com/dfdffd6df3/status/2017176243624354218 · Twitter Post
• https://android.googlesource.com/platform/frameworks/base/+/f2387994151fb5c22c9e645647945e1471fe8ac1 · Note
• https://t.me/cibsecurity/40622 · Telegram Post