CVE-2021-0511 — Improper Input Validation in Google Android

CWE-20 — Improper Input Validation5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 89.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform ARTGoogle Android
Timeline
PublishedJun 21
Latest updateMay 24

Description

In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-178055795

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5google/androidAndroid-9 Android-10 Android-11
▶NVDgoogle/android10.0, 11.0, 9.0+2
▶Androidplatform/art9:0 — 9:2021-06-01+2

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-mhw4-w4wq-p4wx: In Dex2oat of dex2oat↗2022-05-24
▶
CVEList
CVE-2021-0511: In Dex2oat of dex2oat↗2021-06-21
▶
OSV
CVE-2021-0511: In Dex2oat of dex2oat↗2021-06-01
▶

📋Vendor Advisories

1
Android
CVE-2021-0511: Android Security Bulletin 2021-06-01 CVE: CVE-2021-0511 Severity: HIGH Type: EoP Affected AOSP versions: 9, 10, 11 References: A-178055795 [2] [3]↗2021-06-01
▶
CVE-2021-0511 — Improper Input Validation in Google | cvebase