Log in Start free

Vulnerability · Published Feb 10, 2021 · Assigned by google_android

CVE-2021-0326

High 7.5

In plain English

A high-severity security flaw in Android. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)5.0%top 7.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20wpa_supplicant2.9-r10ALPINE-CVE-2021-0326
Alpine:v3.21wpa_supplicant2.9-r10ALPINE-CVE-2021-0326
Alpine:v3.22wpa_supplicant2.9-r10ALPINE-CVE-2021-0326
Alpine:v3.23wpa_supplicant2.9-r10ALPINE-CVE-2021-0326
Alpine:v3.24wpa_supplicant2.9-r10ALPINE-CVE-2021-0326
Debian:12wpa2:2.9.0-17DEBIAN-CVE-2021-0326
Debian:13wpa2:2.9.0-17DEBIAN-CVE-2021-0326
Debian:14wpa2:2.9.0-17DEBIAN-CVE-2021-0326
Rocky Linux:8wpa_supplicant1:2.9-5.el8RLSA-2021:1686

Affected products (as reported)

VendorProductVersions
n/a Android Android-10 Android-11 Android-8.1 Android-9

References