CVE-2021-0326: High severity Google Android vulnerability

Q: What is CVE-2021-0326?

CVE-2021-0326 is a vulnerability in the p2p_copy_client_info function of p2p.c that allows for a possible out of bounds write due to a missing bounds check.

Q: What is the severity of CVE-2021-0326?

The severity of CVE-2021-0326 is critical with a CVSSv3 score of 7.5.

Q: Which software versions are affected by CVE-2021-0326?

The affected software versions include wpa 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1, 2.1-0ubuntu1.7+, 2:2.9.0-17, and 2.4-0ubuntu6.7.

Q: How can I fix CVE-2021-0326?

To fix CVE-2021-0326, update the affected software to the recommended versions: 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1, 2.1-0ubuntu1.7+, 2:2.9.0-17, or 2.4-0ubuntu6.7.

Q: Is user interaction required for exploitation of CVE-2021-0326?

No, user interaction is not needed for exploitation of CVE-2021-0326.

Published Feb 1, 2021

Updated

In p2pcopyclientinfo of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

16 affected componentsFixes available

debian/wpa<=2:2.7+git20190128+0c1e29f-6, <=2:2.7+git20190128+0c1e29f-6+deb10u2, <=2:2.9.0-16

2:2.9.0-172:2.7+git20190128+0c1e29f-6+deb10u3

debian/wpa

2:2.9.0-21+deb11u22:2.10-12+deb12u22:2.10-22

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android=11.0

Fedoraproject Fedora=32

Fedoraproject Fedora=34

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Google Android

android/platform/external/wpa_supplicant_8>=8.0:0<8.0:2021-02-01

8.0:2021-02-01

android/platform/external/wpa_supplicant_8>=8.1:0<8.1:2021-02-01

8.1:2021-02-01

android/platform/external/wpa_supplicant_8>=9:0<9:2021-02-01

9:2021-02-01

android/platform/external/wpa_supplicant_8>=10:0<10:2021-02-01

10:2021-02-01

android/platform/external/wpa_supplicant_8>=11:0<11:2021-02-01

11:2021-02-01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/wpa to a version that resolves this vulnerability.
Fixed in 2:2.9.0-17Fixed in 2:2.7+git20190128+0c1e29f-6+deb10u3
Upgrade
Upgrade debian/wpa to a version that resolves this vulnerability.
Fixed in 2:2.9.0-21+deb11u2Fixed in 2:2.10-12+deb12u2Fixed in 2:2.10-22
Upgrade
Upgrade android/platform/external/wpa_supplicant_8 to a version that resolves this vulnerability.
Fixed in 8.0:2021-02-01
Upgrade
Upgrade android/platform/external/wpa_supplicant_8 to a version that resolves this vulnerability.
Fixed in 8.1:2021-02-01
Upgrade
Upgrade android/platform/external/wpa_supplicant_8 to a version that resolves this vulnerability.
Fixed in 9:2021-02-01
Upgrade
Upgrade android/platform/external/wpa_supplicant_8 to a version that resolves this vulnerability.
Fixed in 10:2021-02-01
Upgrade
Upgrade android/platform/external/wpa_supplicant_8 to a version that resolves this vulnerability.
Fixed in 11:2021-02-01

Event History

Feb 1, 2021

CVE Published

via Android·12:00 AM

Advisory Published

via OSV·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Feb 10, 2021

CVE Published

via MITRE·04:50 PM

Data Sourced

via MITRE·04:50 PM

DescriptionWeakness

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jan 17, 2022

Exploit Published

via GitHub·09:35 PM

Frequently Asked Questions

What is CVE-2021-0326?

CVE-2021-0326 is a vulnerability in the p2p_copy_client_info function of p2p.c that allows for a possible out of bounds write due to a missing bounds check.

What is the severity of CVE-2021-0326?

The severity of CVE-2021-0326 is critical with a CVSSv3 score of 7.5.

Which software versions are affected by CVE-2021-0326?

The affected software versions include wpa 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1, 2.1-0ubuntu1.7+, 2:2.9.0-17, and 2.4-0ubuntu6.7.

How can I fix CVE-2021-0326?

To fix CVE-2021-0326, update the affected software to the recommended versions: 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1, 2.1-0ubuntu1.7+, 2:2.9.0-17, or 2.4-0ubuntu6.7.

Is user interaction required for exploitation of CVE-2021-0326?

No, user interaction is not needed for exploitation of CVE-2021-0326.

CVE-2021-0326: High severity Google Android vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What is CVE-2021-0326?

What is the severity of CVE-2021-0326?

Which software versions are affected by CVE-2021-0326?

How can I fix CVE-2021-0326?

Is user interaction required for exploitation of CVE-2021-0326?

Company

Resources

Contact