Lucene search

Google_androidCVE-2021-0963

HistoryDec 15, 2021 - 7:15 p.m.

CVE-2021-0963

2021-12-1519:15:11

CWE-1021

google_android

web.nvd.nist.gov

cve-2021-0963

keychainactivity

android

security

escalation of privilege

tapjacking

overlay attack

nvd

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

17.8%

JSON

In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-199754277

Affected configurations

Nvd

Vulners

Node

googleandroidMatch9.0

googleandroidMatch10.0

googleandroidMatch11.0

googleandroidMatch12.0

VendorProductVersionCPE
googleandroid9.0cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*
googleandroid10.0cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
googleandroid11.0cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*
googleandroid12.0cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	9.0	cpe:2.3:o:google:android:9.0:::::::*
google	android	10.0	cpe:2.3:o:google:android:10.0:::::::*
google	android	11.0	cpe:2.3:o:google:android:11.0:::::::*
google	android	12.0	cpe:2.3:o:google:android:12.0:::::::*

CNA Affected

[
  {
    "product": "Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Android-10 Android-11 Android-12 Android-9"
      }
    ]
  }
]

References

source.android.com/security/bulletin/2021-12-01

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

17.8%

JSON

Related for CVE-2021-0963