CVE-2021-39635

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	Android	Android SoC

References

https://source.android.com/security/bulletin/2022-02-01Vendor Advisory
https://source.android.com/security/bulletin/2022-02-01Vendor Advisory

Timeline

Published: Feb 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-396364.4In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This coul CVE-2021-396374.4In CreateDeviceInfo of trusty_remote_provisioning_context.cpp, there is a possible out of bounds read due to a missing bounds check. This co CVE-2021-396386.7In periodic_io_work_func of lwis_periodic_io.c, there is a possible out of bounds write due to a use after free. This could lead to local es CVE-2021-396396.8In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. This could lead to local escalation of pr CVE-2021-39645.9elgg is vulnerable to Authorization Bypass Through User-Controlled Key CVE-2021-396407.8In __dwc3_gadget_ep0_queue of ep0.c, there is a possible out of bounds write due to improper locking. This could lead to local escalation of CVE-2021-396419.8Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/A CVE-2021-396426.4In synchronous_process_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to a race condition. This could lead to local CVE-2021-396436.7In ic_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of the CVE-2021-396449.8Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A CVE-2021-396459.8Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/A CVE-2021-396467.5Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/A