CVE-2021-0517: High severity Google Android vulnerability
In updateCapabilities of ConnectivityService.java, there is a possible incorrect network state determination due to a logic error in the code. This could lead to biasing of networking tasks to occur on non-VPN networks, which could lead to remote information disclosure, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
Which devices are affected?
The affected product and version identified here are Google Android 11.
What does an attacker need to exploit this issue?
The issue is remotely exploitable over the network with low attack complexity. It requires no privileges and no user interaction.
What is the practical impact?
A logic error can incorrectly determine network state and bias networking tasks toward non-VPN networks, potentially disclosing information remotely.
Is a fix available?
Yes. A patch is available for this issue.