CVE-2021-39622: High severity Google Android vulnerability
Published Jan 4, 2022
·Updated
In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-192663648
Affected Software
4 affected components
Google Android=10.0
Google Android=11.0
Google Android=12.0
Google Android
Event History
Jan 4, 2022
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Jan 14, 2022
CVE Published
via MITRE·07:10 PM
Data Sourced
via MITRE·07:10 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs local access and low privileges on the device. No user interaction or additional execution privileges are required.
2
Which Android versions are identified as affected?
Android 10, Android 11, and Android 12 are listed as affected.
3
What is the likely security impact if exploitation succeeds?
Successful exploitation can bypass Factory Reset Protection and result in local escalation of privilege. Confidentiality, integrity, and availability impacts are all rated High in the provided CVSS vector.