CVE-2021-0703

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage. This could lead to local escalation of privilege if the attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-184569329

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-07045.5In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accoun CVE-2021-07057.8In sanitizeSbn of NotificationManagerService.java, there is a possible way to keep service running in foreground and keep granted permission CVE-2021-07065.5In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. CVE-2021-07077.8In dma_buf_release of dma-buf.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi CVE-2021-07087.8In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead t CVE-2021-07345.5In Settings, there is a possible way to determine whether an app is installed without query permissions, due to side channel information dis CVE-2021-07355.5In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to CVE-2021-07697.3In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI. This could le CVE-2021-07997.8In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privil CVE-2021-08699.8In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to r CVE-2021-08708.1In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to remote code executi CVE-2021-08717.8In PVRSRVBridgePMRPDumpSymbolicAddr of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could