CVE-2021-39808: Android Frameworks Base - App can remain foreground forever without showing any notification and can bypass one time permissions
Summary
CVE-2021-39808: In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improper input validation. Affects platform/frameworks/base across 3 version ranges.
>= 10:0, < 10:2022-04-01
>= 11:0, < 11:2022-04-01
>= 12:0, < 12:2022-04-01
Fixed in 10:2022-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a fundamental component of the Android operating system. It provides essential functionalities and APIs for various system services and applications. This vulnerability affects the NotificationManagerTest functionality of the package, specifically the testNotify_blockedChannelGroup method. The vulnerability allows an app to run in the foreground without displaying any notification, bypassing one-time permissions. This can lead to a local escalation of privilege without requiring additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability originates from improper input validation in the createNotificationChannelGroup method of PreferencesHelper.java. Due to this flaw, a service can run in the foreground without notifying the user, potentially leading to unauthorized access and misuse of sensitive resources. Exploitation of this vulnerability does not require any additional execution privileges or user interaction. The impact of this vulnerability can range from unauthorized access to sensitive data to the execution of malicious actions on the device.
How To Fix
Minimum fixed version
10:2022-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is recommended to apply the official fix provided by the Android Open Source Project.
Conclusion
The CVE-2021-39808 vulnerability in the Android Frameworks Base package allows an app to run in the foreground without displaying any notification, bypassing one-time permissions. This can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. It is crucial to apply the official fix provided by the Android Open Source Project to mitigate this vulnerability. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an app to run in the foreground without displaying any notification, bypassing one-time permissions. This can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. The impact can range from unauthorized access to sensitive data to the execution of malicious actions on the device.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects Android versions 10, 11, and 12. However, it has been fixed in the Android Open Source Project as of April 1, 2022.
No, the recommended mitigation for this vulnerability is to update the affected Android device to a version that includes the official fix provided by the Android Open Source Project.
For more information about this vulnerability, you can refer to the official Android Open Source Vulnerability database entry at: https://storage.googleapis.com/android-osv/ASB-A-209966086.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
