CVE-2021-39738: High severity android vulnerability

Published May 10, 2022

Updated

In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-216190509

Affected Software

4 affected components

Google Android=10.0

Google Android=11.0

Google Android=12.0

Google Android=12.1

Event History

May 10, 2022

CVE Published

via MITRE·08:02 PM

Data Sourced

via MITRE·08:02 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs local access and low-level privileges. No user interaction or additional execution privileges are required.

Which Android versions should be assessed?

Assess Android 10, Android 11, Android 12, and Android 12L deployments that include CarSettings. The issue is tracked as Android ID A-216190509.

What is the potential impact after exploitation?

Successful exploitation can allow pairing a Bluetooth device without the user's consent and can result in local privilege escalation. Confidentiality, integrity, and availability are all rated high impact in the supplied CVSS vector.