CVE-2021-39685

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-396867.0In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead CVE-2021-396875.5In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to CVE-2021-396885.5In TBD of TBD, there is a possible out of bounds read due to TBD. This could lead to local information disclosure with no additional executiCVE-2021-396896.7In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code. This could leadCVE-2021-39697.0A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation,CVE-2021-396905.5In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. ThCVE-2021-396917.3In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to localCVE-2021-396927.8In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay CVE-2021-396937.8In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due to a logic error in tCVE-2021-396947.8In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user due to a permissions CVE-2021-396957.8In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code. This could lead to local eCVE-2021-396967.8In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no
CVE-2021-39685: High severity, CVSS 7.8 | Vulnix