CVE-2021-0921: Input Validation
In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195962697
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected product and version identified in the data are Google Android 11. Exploitation is local, so an attacker needs the ability to run with low-level privileges on the device.
Does exploitation require user interaction or additional execution privileges?
No user interaction is required. The vulnerability can enable local privilege escalation without requiring additional execution privileges beyond the attacker’s existing low privileges.
How severe is the impact after successful exploitation?
The CVSS vector rates confidentiality, integrity, and availability impact as high. Successful exploitation can therefore allow an attacker to escalate privileges and potentially fully compromise those security properties on the affected device.