CVE-2021-0520: Use After Free
In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 10:2021-06-01 - Upgrade
Upgrade
android/platform/frameworks/avto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 10 or Android 11 are identified as affected. Exploitation is local, so an attacker needs a foothold on the device rather than network-only access.
What access and interaction does exploitation require?
The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction. No additional execution privileges are needed for the escalation attempt.
What is the potential impact if exploitation succeeds?
Successful exploitation could allow local escalation of privilege. Confidentiality, integrity, and availability impacts are all rated high in the supplied CVSS vector.
What should teams do if affected devices cannot be patched immediately?
A patch is available. The provided data does not specify a workaround or mitigation for unpatched devices.