CVE-2021-0593: High severity Google Android vulnerability
In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 8.1:2021-08-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 9:2021-08-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 10:2021-08-01 - Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 11:2021-08-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-0593?
CVE-2021-0593 is classified as a medium severity vulnerability that allows local escalation of privilege.
How do I fix CVE-2021-0593?
To fix CVE-2021-0593, users should update their Android devices to the latest security patch provided by Google.
What versions of Android are affected by CVE-2021-0593?
CVE-2021-0593 affects Android versions 8.1, 9.0, 10.0, and 11.0.
Is user interaction required to exploit CVE-2021-0593?
No, user interaction is not needed for the exploitation of CVE-2021-0593.
What type of attack does CVE-2021-0593 enable?
CVE-2021-0593 enables a possible local escalation of privilege due to a confused deputy issue.