CVE-2021-0963: EoP Overlay Attack on KeyChainActivity
Summary
CVE-2021-0963: In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. Affects platform/packages/apps/KeyChain across 4 version ranges.
>= 9:0, < 9:2021-12-01
>= 10:0, < 10:2021-12-01
>= 11:0, < 11:2021-12-01
>= 12:0, < 12:2021-12-01
Fixed in 9:2021-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The KeyChainActivity is a component in the Android ecosystem that manages app certificates stored in the keychain. It is responsible for securely storing and retrieving cryptographic keys, certificates, and related information. The keychain provides a secure storage location for sensitive data, ensuring that only authorized apps can access it. However, a vulnerability has been discovered in the KeyChainActivity that allows for a tapjacking/overlay attack, potentially leading to a local escalation of privilege. This vulnerability affects Android versions 9, 10, 11, and 12.
Vulnerability Detail
The vulnerability resides in the onCreate method of KeyChainActivity.java. By exploiting a tapjacking/overlay attack, an attacker can trick the user into interacting with a malicious overlay that appears to be part of the legitimate KeyChainActivity. Through this attack, the attacker can gain access to an app certificate stored in the keychain, enabling them to escalate their privileges locally. The exploitation of this vulnerability requires user interaction.
How To Fix
Minimum fixed version
9:2021-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can minimize the risk by being cautious while interacting with app overlays and ensuring that they only interact with trusted and legitimate interfaces.
Conclusion
The KeyChainActivity vulnerability (CVE-2021-0963) poses a risk of local escalation of privilege through a tapjacking/overlay attack. To mitigate this vulnerability, it is crucial to update the Android operating system to the fixed versions released on or after December 1, 2021. By staying up to date with the latest security patches, users can protect themselves from potential exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/KeyChain →
FAQ
KeyChainActivity is a component in the Android ecosystem that manages app certificates stored in the keychain. It provides a secure storage location for cryptographic keys, certificates, and related information.
A tapjacking/overlay attack is a technique where an attacker overlays a malicious interface on top of a legitimate app interface, tricking the user into interacting with the malicious overlay.
Local escalation of privilege refers to an attacker gaining higher privileges on a system or device, allowing them to perform actions that they are not authorized to do.
This vulnerability affects Android versions 9, 10, 11, and 12.
Yes, Google has addressed this vulnerability in Android versions released on or after December 1, 2021. It is recommended to update the Android operating system to the latest version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/KeyChain.
