CVE-2021-39795: EoP Bypass Storage Restriction in Android 11 - Media Provider
Summary
CVE-2021-39795: In multiple locations of MediaProvider.java, there is a possible way to get read/write access to other applications’ dedicated, app-specific directory within external storage due to a missing permission check. Affects platform/packages/providers/MediaProvider across 4 version ranges.
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 11:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The MediaProvider package in the Android ecosystem is responsible for managing media files and providing access to them for other applications. It handles operations related to storage, such as reading and writing files. The vulnerability in question allows unauthorized read/write access to other applications' dedicated, app-specific directories within external storage. This vulnerability affects Android versions 11, 12, 12L, and 13.
Vulnerability Detail
The vulnerability arises from a missing permission check in multiple locations of the MediaProvider.java file. This oversight enables an attacker to gain read/write access to directories belonging to other applications within external storage. Exploiting this vulnerability could lead to local escalation of privilege, requiring the execution privileges of the user. No user interaction is necessary for exploitation.
How To Fix
Minimum fixed version
11:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the MediaProvider package in Android versions 11, 12, 12L, and 13 is vulnerable to an elevation of privilege vulnerability that allows unauthorized access to other applications' directories within external storage. Developers should apply the provided fix to address this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/providers/MediaProvider →
FAQ
The vulnerability allows unauthorized access to other applications' directories within external storage, potentially leading to the compromise of sensitive data and local privilege escalation.
This vulnerability affects Android versions 11, 12, 12L, and 13.
No, user interaction is not needed for exploitation of this vulnerability.
Exploiting this vulnerability requires the execution privileges of the user.
The provided fix should be applied to the MediaProvider package to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/MediaProvider.
