{"id":"PUB-A-137395936", "published":"2021-06-01T00:00:00Z", "modified":"2026-09-21T16:00:45.521740994Z", "aliases":["CVE-2021-0571", "A-137395936"], "details":"In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access to restricted activities due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2021-06-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7", "https://android.googlesource.com/platform/frameworks/base/+/520f1e7497b2edff3d54b069b793645d0462cf97"], "severity":"High", "spl":"2021-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["168002150002739841216163681226141405722", "134001871090367896592995679405183435682", "283649834669009943075993500140214384108", "114919511681757600587125165555614849546", "114653030879734487423729425510938145647", "193153950767726930877298025010031967607", "43013796217171146202320765303604346924", "227627402932546077660412105895810201130", "19431135875074681177035253269890888506", "6223724284595797624969744586704819017", "81028804551533510035655537728189580959", "234036589339156461863573251643003819735", "199178412494287388114426234181914176940", "333812655541118583017039370273097657608", "106048491485463350391552146488809079736", "242542062537183986004743160777371014375", "116861600944624206595352138524419053966", "141259437422195616904197683218102837080", "98838307943114504317127408193165359363", "83034465256773543968021506380621518421", "280028471372599161953508649678037209884", "327396601696858655116338564557430422173", "310899816281044323511827356622578188577", "259584075024216973422030476753896896521", "318633575271986805802308261958741120541", "234430300070175370749896984302580761460", "72017669765762045471399789468758354720", "86624115491635204152577296465612142626", "57526185528647667918831032746423539842", "86142445396029018354743964988565470723", "325773980409615731479113867071136096152", "71277586342689198215765081214134941527", "291345517644819558018070844493227363136", "165031188565881914036238085846543761245", "19977692656016183763499693955357607264", "19817497052788510289881827690582395757", "208711171370057405958858115622817774350", "28940699634314466566677933179244131908", "139283188740284109617514462172760883065", "335705893273117451854106873336083371274", "172163085932447417918153423968448758652", "139462787242239230283410537744935645196", "10274379875322417555391465675032443200", "243996385574188928806559481022308848613", "101822015306538523202976457563094609113", "203636046537379567860966860993609848614", "17330832262448084772890648158432335687", "156243692270266840056286420696080258484", "319597564788803758434277946181257877426", "237928208965721304393823713237712991326", "67178514010594455736009144185633139761", "72573199499557185085811452661577632279", "258803872203363228126800201592579905026", "316299419311655281772991813172702462563", "324227669740738292927336668891907747053", "111208634022797067511504793178577429426", "209093672196453915466636530611796975990"], "threshold":0.9}, "id":"PUB-A-137395936-05adeb70", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"141233750278356415247477638360520126934", "length":236}, "id":"PUB-A-137395936-18a75224", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"getAppTasks"}}, {"deprecated":false, "digest":{"function_hash":"165007624212950936217783718510644541515", "length":616}, "id":"PUB-A-137395936-26dc1f97", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivityWithConfig"}}, {"deprecated":false, "digest":{"function_hash":"254454828739398420494681918754895712925", "length":718}, "id":"PUB-A-137395936-3222e099", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/AppTaskImpl.java", "function":"startActivity"}}, {"deprecated":false, "digest":{"function_hash":"80683627543310294240949723430925264010", "length":804}, "id":"PUB-A-137395936-33706f35", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7", "target":{"file":"services/core/java/com/android/server/UiModeManagerService.java", "function":"sendConfigurationAndStartDreamOrDockAppLocked"}}, {"deprecated":false, "digest":{"function_hash":"249945443157976983372054761248010022287", "length":641}, "id":"PUB-A-137395936-3d83cf43", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivityAsUser"}}, {"deprecated":false, "digest":{"function_hash":"104230171459412815452588875810047418045", "length":352}, "id":"PUB-A-137395936-46745310", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivitiesInPackage"}}, {"deprecated":false, "digest":{"function_hash":"20502195857860504595551690392692331820", "length":481}, "id":"PUB-A-137395936-775d08e9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startAssistantActivity"}}, {"deprecated":false, "digest":{"line_hashes":["329362196407775060224646270381045210596", "114373874547952663955307802600237323298", "178986866803594840573537345460715833823", "143284661680706795474613429432547941490", "250527303051710343006063998433446126061", "27433135051089293122746371569790755495", "325378707303461159989147193797744898228", "54842175945111109135017946979309559893", "318681472263896023882156917364221137030", "19977692656016183763499693955357607264", "195457493475686173427436862703363886531", "1022028090547309964183528961917947844", "38945781856767510718860027758718514511", "131021580069016129519827063581373766153", "69859918373355420808766785637849396468", "232632413166406318650229108009220327108", "247746510270556502795020643616815958216"], "threshold":0.9}, "id":"PUB-A-137395936-78ca0c23", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/AppTaskImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"319391820664263321493639708659641833507", "length":421}, "id":"PUB-A-137395936-861ac77a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"function_hash":"92357934167385911137102987977524032055", "length":666}, "id":"PUB-A-137395936-8faf12d1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivityAndWait"}}, {"deprecated":false, "digest":{"line_hashes":["120133855072458302708880813791042757129", "313377708358512695002429498442777546195", "198653262975074420650704456818989273425", "97105502174761260707753732152002318771", "135779943471888418407536876270755124417"], "threshold":0.9}, "id":"PUB-A-137395936-bc0ae433", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7", "target":{"file":"services/core/java/com/android/server/UiModeManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"81279417598857111710546957814737053060", "length":705}, "id":"PUB-A-137395936-becc705e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startVoiceActivity"}}, {"deprecated":false, "digest":{"line_hashes":["66749074526194242030944232447760428162", "17459012581173878130978390013546608566", "83976425293805186350994445804737817211", "272950675460115238438366488829158775001", "302648306616857165946800382045739521614", "248081305242231474049293081813798928776", "30446384021628305209843556498497096154", "255776652827034237454716963463250172764"], "threshold":0.9}, "id":"PUB-A-137395936-c3fa2d62", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7", "target":{"file":"services/core/java/com/android/server/policy/PhoneWindowManager.java"}}, {"deprecated":false, "digest":{"line_hashes":["265417339396258012684593381357532180899", "15210335708124496907401137095957383270", "27605101375669741956055703004038240797", "256924176236647211266048454880562547422"], "threshold":0.9}, "id":"PUB-A-137395936-d09c9a8a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStackSupervisor.java"}}, {"deprecated":false, "digest":{"function_hash":"315949899020848254423689844796501465554", "length":1165}, "id":"PUB-A-137395936-e21db41f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7", "target":{"file":"services/core/java/com/android/server/policy/PhoneWindowManager.java", "function":"goHome"}}, {"deprecated":false, "digest":{"function_hash":"337749010423866867468838380460361667694", "length":1088}, "id":"PUB-A-137395936-e75013ba", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStackSupervisor.java", "function":"getActionRestrictionForCallingPackage"}}, {"deprecated":false, "digest":{"function_hash":"264031356635378254347255764229287469093", "length":1506}, "id":"PUB-A-137395936-f1798eac", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}, {"deprecated":false, "digest":{"function_hash":"84510986583101754706421048430227129944", "length":462}, "id":"PUB-A-137395936-f6ea12dd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"startActivityInPackage"}}, {"deprecated":false, "digest":{"function_hash":"203228634119653363759680835009376471065", "length":953}, "id":"PUB-A-137395936-f77a1b86", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f", "target":{"file":"services/core/java/com/android/server/wm/AppTaskImpl.java", "function":"moveToFront"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2021-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/520f1e7497b2edff3d54b069b793645d0462cf97"}]}