CVE-2021-0505: High severity Google Android vulnerability
In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs local access with low privileges. No user interaction or additional execution privileges are required.
What is the security impact if exploitation succeeds?
An attacker may be able to disable an always-on VPN, resulting in local escalation of privilege. The CVSS vector indicates high impact to confidentiality, integrity, and availability.
Which Android release is identified as affected?
The affected version listed is Android 11.
Is a fix available?
Yes. A patch is available.