CVE-2021-1021: Input Validation
In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected product and version identified are Android 12. Exploitation is local, so an attacker needs access to execute code on the device as a user-level process.
What does an attacker need to exploit it?
The attacker needs User execution privileges and user interaction. The issue is caused by improper input validation in NotificationManagerService's snoozeNotificationInt path.
What is the practical impact?
A successful exploit can disable notifications for an arbitrary user, resulting in local escalation of privilege with high confidentiality, integrity, and availability impact according to the supplied severity vector.