CVE-2021-0682: Medium severity Google Android vulnerability
In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 8.1:2021-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 9:2021-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 10:2021-09-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2021-09-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-0682?
The severity of CVE-2021-0682 is considered moderate due to the potential for local information disclosure.
How do I fix CVE-2021-0682?
To fix CVE-2021-0682, ensure that your Android device is updated to the latest version that has addressed this vulnerability.
What versions of Android are affected by CVE-2021-0682?
CVE-2021-0682 affects Android versions 8.1, 9.0, 10.0, and 11.0.
What type of attack does CVE-2021-0682 involve?
CVE-2021-0682 involves a local information disclosure attack due to a missing permission check in the NotificationManagerService.
Can CVE-2021-0682 be exploited remotely?
No, CVE-2021-0682 requires local execution privileges, making it a local attack vector.