CVE-2021-0400: Input Validation

Published Apr 5, 2021

Updated

In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-177561690

Affected Software

4 affected components

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2021-04-01

Event History

Apr 5, 2021

CVE Published

via Android·12:00 AM

Apr 13, 2021

CVE Published

via MITRE·06:25 PM

Data Sourced

via MITRE·06:25 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Devices running Android 9, Android 10, or Android 11 are affected. Exploitation requires local access with user-level execution privileges; no user interaction is required.

What is the potential impact of exploitation?

An attacker could cause incorrect location data to be reported to emergency services. The CVSS vector indicates integrity impact without confidentiality or availability impact.

Is a fix available?

Yes. A patch is available, with remediation information included in the April 2021 Android security bulletin and the referenced Android source change.