CVE-2021-39635 Missing authorization in Android
Normal apps can access sensitive VoLTE information and manage calls due to missing permission checks in the ims_ex service on Android devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39635?
CVE-2021-39635 is a critical missing authorization vulnerability in Google Android, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634
Weakness: CWE-276
Which versions are affected by CVE-2021-39635?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2021-39635?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-39635 being exploited?
There is no known exploitation of CVE-2021-39635 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as 1731024, A-206492634, ASB-A-206492634, GHSA-xv84-3fv6-rp2r.