A vulnerability has been found in Google Android (Smartphone Operating System) (version unknown) and classified as critical. This vulnerability affects the function hasActivityInVisibleTask of the file WindowProcessController.java. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In hasActivityInVisibleTask of WindowProcessController.java there?s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138583650

The weakness was released 12/06/2019. This vulnerability was named CVE-2019-2221 since 12/10/2018. The attack needs to be approached locally. The successful exploitation requires a single authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/09/2024). It is expected to see the exploit prices for this product increasing in the near future.

Applying a patch is able to eliminate this problem.

Entries connected to this vulnerability are available at VDB-146780, VDB-146779, VDB-146778 and VDB-146777.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion