CVE-2021-0922: High severity Google Android vulnerability
In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACTACROSSPROFILES permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-195630721
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 11 are identified as affected. Exploitation is local, so an attacker needs access to execute code on the device rather than network-only access.
What does an attacker need to exploit it?
The attacker needs low privileges on the device. No user interaction is required, and no additional execution privileges are needed beyond the ability to run locally.
What is the likely impact of successful exploitation?
Successful exploitation could bypass the INTERACT_ACROSS_PROFILES permission check and result in local privilege escalation. Confidentiality, integrity, and availability impacts are all rated high in the supplied CVSS vector.