CVE-2021-0571: High severity Google Android vulnerability
In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access to restricted activities due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected product and version listed are Android 11. Exploitation is local, so the attacker needs to be able to run code on the device.
What does an attacker need to exploit it?
The issue has low attack complexity and requires low privileges. It does not require user interaction or any additional execution privileges.
What is the impact if exploitation succeeds?
An attacker may access restricted activities through a permissions bypass, resulting in local escalation of privilege. The listed impact includes high confidentiality, integrity, and availability effects.
How can I identify the relevant Android security issue?
This issue is identified as Android ID A-137395936 and CVE-2021-0571. The provided references include the June 1, 2021 Android and Pixel security bulletins and a frameworks/base source change.