CVE-2021-0322: Input Validation

Q: Which Android versions are affected?

The affected versions listed are Android 9, Android 10, and Android 11. The issue is in the Android framework component android/platform/frameworks/base, specifically SlicePermissionActivity.java.

Q: What does an attacker need to exploit this issue?

Exploitation requires local access with User-level execution privileges and user interaction. The reported impact is local information disclosure through a misleading string displayed by SlicePermissionActivity.

Q: Is this a remote attack?

No. The attack vector is local, so an attacker must already be able to execute in a User context on the device.

Q: How can I identify the relevant Android security fix?

The issue is tracked as Android ID A-159145361 and is included in the Android Security Bulletin dated 2021-01-01. The supplied references also identify framework source changes associated with the fix.

Published Jan 1, 2021

Updated

In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.

Affected Software

7 affected componentsFixes available

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

android/platform/frameworks/base>=9:0<9:2021-01-01

9:2021-01-01

android/platform/frameworks/base>=10:0<10:2021-01-01

10:2021-01-01

android/platform/frameworks/base>=11:0<11:2021-01-01

11:2021-01-01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 9:2021-01-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 10:2021-01-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 11:2021-01-01

Event History

Jan 1, 2021

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Jan 4, 2021

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Jan 11, 2021

CVE Published

via MITRE·09:47 PM

Data Sourced

via MITRE·09:47 PM

DescriptionWeakness

Frequently Asked Questions

Which Android versions are affected?

The affected versions listed are Android 9, Android 10, and Android 11. The issue is in the Android framework component android/platform/frameworks/base, specifically SlicePermissionActivity.java.

What does an attacker need to exploit this issue?

Exploitation requires local access with User-level execution privileges and user interaction. The reported impact is local information disclosure through a misleading string displayed by SlicePermissionActivity.

Is this a remote attack?

No. The attack vector is local, so an attacker must already be able to execute in a User context on the device.

How can I identify the relevant Android security fix?

The issue is tracked as Android ID A-159145361 and is included in the Android Security Bulletin dated 2021-01-01. The supplied references also identify framework source changes associated with the fix.

CVE-2021-0322: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Android versions are affected?

What does an attacker need to exploit this issue?

Is this a remote attack?

How can I identify the relevant Android security fix?

Company

Resources

Contact

Frequently Asked Questions

Which Android versions are affected?

What does an attacker need to exploit this issue?

Is this a remote attack?

How can I identify the relevant Android security fix?