CVE-2021-1024: Medium severity Google Android vulnerability
In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Android 12 devices are affected. Exploitation is local, so an attacker would need to execute code on the device rather than attack it remotely.
What level of access does an attacker need?
The vulnerability requires System execution privileges. No user interaction is needed once those privileges are available.
What is the potential impact if exploited?
The issue can enable local escalation of privilege through intent redirection caused by a confused deputy. The listed impact includes high confidentiality, integrity, and availability effects.