Lucene search

Google_androidCVE-2021-0904

HistoryDec 15, 2021 - 7:15 p.m.

CVE-2021-0904

2021-12-1519:15:10

CWE-732

google_android

web.nvd.nist.gov

cve-2021-0904

sramrom

permission bypass

local escalation

privilege

security patch

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06076938; Issue ID: ALPS06076938.

Affected configurations

Nvd

Vulners

Node

mediatekmt6771Match-

mediatekmt8183Match-

mediatekmt8385Match-

mediatekmt8788Match-

AND

googleandroidMatch8.1

googleandroidMatch9.0

googleandroidMatch10.0

googleandroidMatch11.0

VendorProductVersionCPE
mediatekmt6771-cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*
mediatekmt8183-cpe:2.3:h:mediatek:mt8183:-:*:*:*:*:*:*:*
mediatekmt8385-cpe:2.3:h:mediatek:mt8385:-:*:*:*:*:*:*:*
mediatekmt8788-cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*
googleandroid8.1cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
googleandroid9.0cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*
googleandroid10.0cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
googleandroid11.0cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mediatek	mt6771	-	cpe:2.3:h:mediatek:mt6771:-:::::::*
mediatek	mt8183	-	cpe:2.3:h:mediatek:mt8183:-:::::::*
mediatek	mt8385	-	cpe:2.3:h:mediatek:mt8385:-:::::::*
mediatek	mt8788	-	cpe:2.3:h:mediatek:mt8788:-:::::::*
google	android	8.1	cpe:2.3:o:google:android:8.1:::::::*
google	android	9.0	cpe:2.3:o:google:android:9.0:::::::*
google	android	10.0	cpe:2.3:o:google:android:10.0:::::::*
google	android	11.0	cpe:2.3:o:google:android:11.0:::::::*

CNA Affected

[
  {
    "product": "MT6771, MT8183, MT8385, MT8788",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android 8.1, 9.0, 10.0, 11.0"
      }
    ]
  }
]

References

corp.mediatek.com/product-security-bulletin/December-2021

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-0904