CVE-2021-0595: High severity Google Android vulnerability

Published Sep 7, 2021

Updated

In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096

Affected Software

5 affected components

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android=11.0

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2021-09-01

Event History

Sep 7, 2021

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Oct 6, 2021

CVE Published

via MITRE·02:10 PM

Data Sourced

via MITRE·02:10 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-0595?

CVE-2021-0595 is rated as a high severity vulnerability due to its potential for local escalation of privilege without requiring additional execution permissions.

How do I fix CVE-2021-0595?

Fixing CVE-2021-0595 involves updating Android to the latest version released by Google that addresses this vulnerability.

What are the affected versions in CVE-2021-0595?

CVE-2021-0595 affects Google Android versions 8.1, 9.0, 10.0, and 11.0.

What type of exploitation is possible with CVE-2021-0595?

CVE-2021-0595 allows unauthorized access to the work profile without requiring the profile PIN, potentially compromising user privacy.

Is user interaction needed to exploit CVE-2021-0595?

No, user interaction is not needed to exploit CVE-2021-0595, making it more dangerous.