CVE-2021-1019: High severity Google Android vulnerability
In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The affected product and version identified are Google Android 12, in the Android Settings component. The issue is tracked as Android ID A-195031401.
What access does an attacker need to exploit this?
Exploitation requires local User-level execution privileges and user interaction. The attack relies on a misleading user consent dialog, so it is not described as remotely exploitable.
How can I identify potentially affected devices?
Identify devices running Android 12 and check them against the Android security bulletins published on 2021-12-01 for Android ID A-195031401. The provided data does not specify a patch level or fixed build number.