CVE-2021-39704: App can remain foreground forever without showing any notification and can bypass one time permissions
Summary
CVE-2021-39704: In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a permissions bypass. Affects platform/frameworks/base across 3 version ranges.
>= 11:0, < 11:2022-03-01
>= 12:0, < 12:2022-03-01
>= 12L:0, < 12L:2022-03-01
Fixed in 11:2022-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the platform/frameworks/base package in the Android ecosystem. This package is a fundamental part of the Android operating system, providing core functionalities and services. It is responsible for managing various system components, including notifications. The vulnerability allows an app to run as a foreground service without displaying any user notification, bypassing one-time permissions. This can lead to a local escalation of privilege without requiring additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability exists in the deleteNotificationChannelGroup method of the NotificationManagerService.java file. It allows an app to exploit a permissions bypass, enabling it to run as a foreground service without notifying the user. This can be abused by malicious apps to gain elevated privileges on the device. The impact of this vulnerability is significant as it can be exploited without user interaction and without the need for additional execution privileges.
How To Fix
Minimum fixed version
11:2022-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patch or update the affected Android version to mitigate the risk.
Conclusion
The vulnerability in the platform/frameworks/base package allows an app to run as a foreground service without displaying any user notification and bypassing one-time permissions. This can lead to a local escalation of privilege, enabling malicious apps to gain elevated privileges on the device. It is recommended to apply the provided patch or update the affected Android version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an app to run as a foreground service without displaying any user notification and bypassing one-time permissions. This can lead to a local escalation of privilege, enabling malicious apps to gain elevated privileges on the device.
No, this vulnerability requires the app to be installed on the device and does not have a remote exploitation vector.
No, user interaction is not needed for exploitation. The app can exploit the vulnerability without any user input.
The vulnerability affects Android versions 10, 11, 12, and 12L. It is recommended to update to a fixed version released after March 1, 2022.
No, there is no known workaround. It is crucial to apply the provided patch or update the affected Android version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
