CVE-2021-1016: High severity Google Android vulnerability
In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker needs to get a user to interact with a tapjacking or overlay attack. The attacker also needs local, user-level execution privileges.
What access could be gained if exploitation succeeds?
A malicious app could be granted access to USB without the user’s informed consent. The reported impact includes escalation of privilege and potential compromise of confidentiality, integrity, and availability.
Which Android version is identified as affected?
The provided data identifies Android 12 as affected.
How can I determine whether a device has the fix?
The data does not provide a specific fixed version or patch level. Compare the device’s Android security patch information with the December 1, 2021 Android security bulletin and the referenced framework change.