CVE-2021-0649: High severity Google Android vulnerability
In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROLALWAYSONVPN with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191382886
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker with low privileges can exploit it. The CVSS vector indicates that no user interaction is required and that exploitation does not require additional execution privileges.
What is the impact of successful exploitation?
Successful exploitation can reset a VPN profile and allow escalation to the CONTROL_ALWAYS_ON_VPN privilege. Confidentiality, integrity, and availability impacts are rated high in the supplied CVSS vector.
Which Android versions are identified as affected?
The provided data identifies Android 11 as affected.