What is the severity of CVE-2021-39701?

CVE-2021-39701 is classified as a high severity vulnerability due to its potential for local escalation of privilege.

How do I fix CVE-2021-39701?

To fix CVE-2021-39701, update your Android operating system to the latest version provided by Google.

Which Android versions are affected by CVE-2021-39701?

CVE-2021-39701 affects Android versions 11.0 and 12.0.

What are the risks associated with CVE-2021-39701?

The risks associated with CVE-2021-39701 include the possibility of a service running in the foreground without user notification or permission.

Can CVE-2021-39701 be exploited remotely?

CVE-2021-39701 requires local access to the device, meaning it cannot be exploited remotely.

Vulnerability/
CVE-2021-39701

critical

9.3

CWE

7/3/2022

16/3/2022

26/8/2024

CVE-2021-39701: Input Validation

First published: Mon Mar 07 2022(Updated: )

In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foreground without notification or permission due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-212286849

Credit: security@android.com

Affected Software	Affected Version	How to fix
Android
Android	=11.0
Android	=12.0

Remedy

https://source.android.com/security/bulletin/2022-03-01

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-39701?
CVE-2021-39701 is classified as a high severity vulnerability due to its potential for local escalation of privilege.
How do I fix CVE-2021-39701?
To fix CVE-2021-39701, update your Android operating system to the latest version provided by Google.
Which Android versions are affected by CVE-2021-39701?
CVE-2021-39701 affects Android versions 11.0 and 12.0.
What are the risks associated with CVE-2021-39701?
The risks associated with CVE-2021-39701 include the possibility of a service running in the foreground without user notification or permission.
Can CVE-2021-39701 be exploited remotely?
CVE-2021-39701 requires local access to the device, meaning it cannot be exploited remotely.

agent/type
agent/first-publish-date
agent/severity
agent/weakness
agent/references
agent/author
agent/remedy
agent/description
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/event
agent/last-modified-date
agent/source
agent/tags
collector/android-source
source/Android
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-index
vendor/google
canonical/android
version/android/11.0
version/android/12.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.