CVE-2021-39696: Task hijacking via relinquishTaskIdentity attribute
Summary
CVE-2021-39696: In Task.java, there is a possible escalation of privilege due to a confused deputy. Affects platform/frameworks/base across 3 version ranges.
>= 10:0, < 10:2022-08-01
>= 11:0, < 11:2022-08-01
>= 12:0, < 12:2022-08-01
Fixed in 10:2022-08-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base, which is a part of the Android ecosystem. This package provides the fundamental building blocks for the Android operating system, including various libraries, services, and frameworks. It is responsible for managing tasks and processes, handling user interactions, and providing essential functionalities to Android applications.
Vulnerability Detail
The vulnerability identified as CVE-2021-39696 is a privilege escalation issue in the Task.java file. It involves a confused deputy scenario, where an attacker can exploit a flaw in the implementation to escalate their privileges locally without requiring additional execution privileges. The vulnerability requires user interaction for exploitation. If successfully exploited, an attacker could gain unauthorized access to sensitive resources or perform malicious actions with elevated privileges.
How To Fix
Minimum fixed version
10:2022-08-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, CVE-2021-39696 is a privilege escalation vulnerability in the platform/frameworks/base package of the Android ecosystem. It allows an attacker to escalate their privileges locally without requiring additional execution privileges. User interaction is needed for successful exploitation. It is recommended to apply the provided fixes to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is a local privilege escalation, allowing an attacker to gain elevated privileges on the affected Android system.
Yes, user interaction is needed for successful exploitation of this vulnerability.
The vulnerability affects Android versions 10, 11, and 12.
There are no known instances of this vulnerability being exploited in the wild.
Yes, fixes have been provided for the affected versions of the platform/frameworks/base package.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
