CVE-2019-2221: High severity Google Android vulnerability

Published Dec 2, 2019

Updated

In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138583650

Affected Software

2 affected components

Google Android=10.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2019-12-01

Event History

Dec 2, 2019

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Dec 6, 2019

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access and low-level privileges on an affected Android 10 device. No user interaction or additional execution privileges are required.

What is the impact if exploitation succeeds?

Successful exploitation can result in local escalation of privilege and compromise confidentiality, integrity, and availability.

What should organizations do to remediate this issue?

Apply the available Android security patch for this vulnerability. The referenced Android fix updates WindowProcessController.java handling of top activities in the INITIALIZING state.