CVE-2021-39627: callVoicemailPendingIntent could be Hijacked to Access Contacts in platform/packages/apps/Dialer
Summary
CVE-2021-39627: In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. Affects platform/packages/apps/Dialer across 4 version ranges.
>= 9:0, < 9:2022-01-01
>= 10:0, < 10:2022-01-01
>= 11:0, < 11:2022-01-01
>= 12:0, < 12:2022-01-01
Fixed in 9:2022-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/packages/apps/Dialer package is a part of the Android ecosystem and is responsible for managing the dialer functionality on Android devices. It allows users to make phone calls, manage contacts, and access voicemail. This package is vulnerable to a specific issue that could potentially allow an attacker to bypass permissions and gain unauthorized access to contacts.
Vulnerability Detail
The vulnerability, identified as CVE-2021-39627, exists in the sendLegacyVoicemailNotification function of the LegacyModeSmsHandler.java file in the platform/packages/apps/Dialer package. The issue arises due to an unsafe PendingIntent, which can be exploited to bypass permissions and escalate privileges locally. This means that an attacker with user execution privileges could potentially exploit this vulnerability without requiring any user interaction. The impact of this vulnerability could be significant, as it allows unauthorized access to contacts, potentially leading to privacy breaches and misuse of personal information.
How To Fix
Minimum fixed version
9:2022-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the official fix mentioned above.
Conclusion
In conclusion, the platform/packages/apps/Dialer package is vulnerable to CVE-2021-39627, which allows unauthorized access to contacts. It is crucial to apply the provided fix to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/packages/apps/Dialer →
FAQ
This vulnerability could allow an attacker to bypass permissions and gain unauthorized access to contacts, potentially leading to privacy breaches and misuse of personal information.
No, user interaction is not needed for exploitation. An attacker with user execution privileges can exploit this vulnerability without any user interaction.
The vulnerability was introduced in version 9 and affects versions 9, 10, 11, and 12 of the platform/packages/apps/Dialer package.
There are no known instances of this vulnerability being exploited at the moment.
You can find more information about this vulnerability in the official Android Open Source Project (AOSP) Security Bulletin: https://storage.googleapis.com/android-osv/ASB-A-185126549.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Dialer.
