CVE-2021-0645

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an app to read private app directories in external storage, which should be restricted in Android 11, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157320644

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-06467.8In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. This could lead to local escCVE-2021-06497.8In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of priCVE-2021-06506.5In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remotCVE-2021-06515.5In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to incorrect input validaCVE-2021-06527.8In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due to sharing of not thrCVE-2021-06535.5In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permCVE-2021-06545.5In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local infCVE-2021-06556.7In mdlactl driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege CVE-2021-06566.7In edma driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System CVE-2021-06576.7In apusys, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege wiCVE-2021-06586.7In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystCVE-2021-06594.4In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with Sys