« Volver al listado

CVE-2021-0904

Estado: ModificadaMedia (6.7)—

En SRAMROM, existe una posible derivación de permisos debido a una configuración de permisos insegura. Esto podría llevar a una escalada local de privilegios con necesidad de privilegios de ejecución del sistema. La interacción del usuario no es necesaria para la explotación. ID del parche: ALPS06076938; ID del problema: ALPS06076938

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Android

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-0904",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@android.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "MT6771, MT8183, MT8385, MT8788",
          "versions": [
            {
              "status": "affected",
              "version": "Android 8.1, 9.0, 10.0, 11.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-15T19:15:10.893",
  "references": [
    {
      "url": "https://corp.mediatek.com/product-security-bulletin/December-2021",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://corp.mediatek.com/product-security-bulletin/December-2021",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06076938; Issue ID: ALPS06076938."
    },
    {
      "lang": "es",
      "value": "En SRAMROM, existe una posible derivación de permisos debido a una configuración de permisos insegura. Esto podría llevar a una escalada local de privilegios con necesidad de privilegios de ejecución del sistema. La interacción del usuario no es necesaria para la explotación. ID del parche: ALPS06076938; ID del problema: ALPS06076938"
    }
  ],
  "lastModified": "2026-06-17T03:30:39.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
            },
            {
              "criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"
            },
            {
              "criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"
            },
            {
              "criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BE4D2AED-C713-407F-A34A-52C3D8F65835"
            },
            {
              "criteria": "cpe:2.3:h:mediatek:mt8183:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "23F65D7B-31A1-4D94-82E9-254A7A6D7BE1"
            },
            {
              "criteria": "cpe:2.3:h:mediatek:mt8385:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "299378ED-41CE-4966-99B1-65D2BA1215EF"
            },
            {
              "criteria": "cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FE10C121-F2AD-43D2-8FF9-A6C197858220"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@android.com"
}