CVE-2021-39707: EoP Bypass CALL_PRIVILEGED permission in Settings AppRestrictionsFragment
Summary
CVE-2021-39707: In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. Affects platform/packages/apps/Settings across 4 version ranges.
>= 10:0, < 10:2022-03-01
>= 11:0, < 11:2022-03-01
>= 12:0, < 12:2022-03-01
>= 12L:0, < 12L:2022-03-01
Fixed in 10:2022-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is the Settings app in the Android ecosystem. This app allows users to configure various settings on their Android devices, such as network, display, and security settings. The AppRestrictionsFragment is a component of the Settings app that handles app restrictions and permissions. It provides a user interface for managing app-specific restrictions and permissions. This vulnerability specifically affects the AppRestrictionsFragment and its handling of the CALL_PRIVILEGED permission.
Vulnerability Detail
The vulnerability in the AppRestrictionsFragment allows for the bypassing of the CALL_PRIVILEGED permission, leading to a confused deputy scenario. In the onReceive method of AppRestrictionsFragment.java, there is a possible way to start a phone call without the necessary permissions. This can result in a local escalation of privilege, where an attacker can initiate phone calls without the user's knowledge or consent. Exploitation of this vulnerability does not require any additional execution privileges and does not rely on user interaction.
How To Fix
Minimum fixed version
10:2022-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the AppRestrictionsFragment of the Settings app allows for the bypassing of the CALL_PRIVILEGED permission, leading to a local escalation of privilege. To mitigate this vulnerability, it is recommended to update to the latest version of the affected package, platform/packages/apps/Settings, which includes the necessary security patches. No specific workaround is mentioned for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
This vulnerability allows for local escalation of privilege, potentially enabling an attacker to make phone calls without the necessary permissions. This can lead to unauthorized phone calls being made without the user's knowledge or consent.
This vulnerability affects multiple versions of the Settings app, including versions 10, 11, 12, and 12L. It is recommended to update to the latest version of the app to ensure the vulnerability is patched.
No, user interaction is not required for exploitation of this vulnerability. An attacker can initiate phone calls without the user's knowledge or consent.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary security patches to mitigate the risk.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the gradle.lockfile, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
