CVE-2021-39703: High severity Google Android vulnerability
In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2022-03-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L:2022-03-01
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low-privileged access on an affected Android 12 device. No user interaction or additional execution privileges are required.
What is the potential impact?
Successful exploitation can allow unauthorized access to files and local escalation of privilege, with high impact to confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available, and the referenced Android security bulletin is dated March 1, 2022.
How can I determine whether a device is affected?
The affected product and version identified here are Google Android 12. Verify whether the device has received the applicable Android security patch containing the fix for Android ID A-207057578.