CVE-2021-0326 Memory corruption in Android

High 7.5 Published 10 Feb 2021 Updated 3 Aug 2024

Remote attackers can execute arbitrary code on Android devices via a Wi-Fi Direct search due to an out-of-bounds write in the P2P component.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-0326?

CVE-2021-0326 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 10 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525

Weakness: CWE-787

Which versions are affected by CVE-2021-0326?

It affects 3 products.

Linux distribution packages (21)

`wpa_supplicant` Red Hat:enterprise_linux:8::baseos	All versions	`1:2.9-5.el8`
`wpa_supplicant-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`1:2.9-5.el8`
`wpa_supplicant-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`1:2.9-5.el8`
`wpa_supplicant` Rocky Linux:8	All versions	`1:2.9-5.el8`
`wpa_supplicant` SUSE:Enterprise Storage 6	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise High Performance Computing 15-LTSS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Module for Basesystem 15 SP2	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.9-23.6.1`
`wpa_supplicant` SUSE:Linux Enterprise Server 15 SP1-BCL	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Server 15-LTSS	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.9-23.6.1`
`wpa_supplicant` SUSE:Linux Enterprise Server for SAP Applications 15	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Manager Proxy 4.0	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Manager Retail Branch Server 4.0	All versions	`2.9-4.23.1`
`wpa_supplicant` SUSE:Manager Server 4.0	All versions	`2.9-4.23.1`
`wpa_supplicant` openSUSE:Leap 15.2	All versions	`2.9-lp152.8.6.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Google Android.

How do I fix CVE-2021-0326?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-0326 being exploited?

There is no known exploitation of CVE-2021-0326 in the wild and no public exploit code.

Public exploit code: 5 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as A-172937525, ALPINE-CVE-2021-0326, ASB-A-172937525, DEBIAN-CVE-2021-0326, DLA-2572-1, GHSA-4wv8-p854-pjqv and 8 more.