⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2021-0956 — Out-of-bounds Write in Google Android

CWE-787 — Out-of-bounds Write4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
1.1%
top 21.94%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Platform Packages Apps NFCGoogle Android
Timeline
PublishedDec 15
Latest updateDec 16

Description

In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additionalSystem execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-189942532

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/androidAndroid-11 Android-12
▶NVDgoogle/android11.0, 12.0+1
▶Androidplatform/packages_apps_nfc11:0 — 11:2021-12-01+1

🔴Vulnerability Details

2
GHSA
GHSA-jvq6-xpq3-8mch: In NfcTag::discoverTechnologies (activation) of NfcTag↗2021-12-16
▶
OSV
CVE-2021-0956: In NfcTag::discoverTechnologies (activation) of NfcTag↗2021-12-01
▶

📋Vendor Advisories

1
Android
CVE-2021-0956: Android Security Bulletin 2021-12-01 CVE: CVE-2021-0956 Severity: CRITICAL Type: EoP Affected AOSP versions: 11, 12 References: A-189942532↗2021-12-01
▶