CVE-2021-39692: Set up Work Profile without User Consent in ManagedProvisioning
Summary
CVE-2021-39692: In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. Affects platform/packages/apps/ManagedProvisioning across 4 version ranges.
>= 10:0, < 10:2022-03-01
>= 11:0, < 11:2022-03-01
>= 12:0, < 12:2022-03-01
>= 12L:0, < 12L:2022-03-01
Fixed in 10:2022-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ManagedProvisioning is an Android package that handles the setup and provisioning of work profiles on Android devices. It is responsible for creating a separate work environment on the device, allowing users to keep their personal and work data separate. This package is a critical component for enterprise device management and security. However, a vulnerability has been identified in the package that allows the setup of a work profile without user consent, potentially leading to a local privilege escalation attack.
Vulnerability Detail
The vulnerability exists in the onCreate method of the SetupLayoutActivity.java file in ManagedProvisioning. An attacker can exploit this vulnerability using a tapjacking/overlay attack, bypassing user consent and setting up a work profile without the user's knowledge or permission. This vulnerability requires user interaction for exploitation. If successfully exploited, an attacker with user execution privileges can escalate their privileges locally, gaining unauthorized access to sensitive work data and potentially compromising the security of the work profile.
How To Fix
Minimum fixed version
10:2022-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the ManagedProvisioning package to a secure version.
Conclusion
The vulnerability in ManagedProvisioning allows the setup of a work profile without user consent, potentially leading to a local privilege escalation attack. It is crucial to update the ManagedProvisioning package to a secure version that includes the necessary security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/ManagedProvisioning →
FAQ
ManagedProvisioning is an Android package responsible for setting up and managing work profiles on Android devices. It allows users to keep their personal and work data separate.
A work profile is a separate environment on an Android device that allows users to keep their work-related apps and data isolated from their personal apps and data. It provides enhanced security and privacy for work-related activities.
This vulnerability allows an attacker to set up a work profile on a user's device without their consent. This can lead to unauthorized access to work-related data and potentially compromise the security of the work profile.
Yes, user interaction is required for exploitation of this vulnerability. The attacker needs to perform a tapjacking/overlay attack to bypass user consent and set up the work profile.
Yes, the vulnerability has been fixed in versions 10, 11, 12, and 12L of the ManagedProvisioning package, released on or after March 1, 2022. It is recommended to update to the latest available version to ensure the vulnerability is patched.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/ManagedProvisioning.
