{"id":"ASB-A-191382886","details":"In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWAYS_ON_VPN with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-191382886","CVE-2021-0649"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2021-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/591e345fbc0ccb6815e27ccff1a0ae9d02002a90"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Connectivity/+/a9ef5a9252761c73959cfb16a838d3c61fee77f3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-11-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11"],"severity":"High","spl":"2021-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/ConnectivityService.java"},"deprecated":false,"digest":{"line_hashes":["249075278512829168754042795387518813750","159388925239194086110019053960304969612","104848444477519217474237556570055385811","97590697546115221432188778181145799833","95975522758785182856088401938732163268","38729615384395579501124902717966760349","40135872218419544498134803688603443737","178413717962493023367993335606776715959","246714061973602262374419698083005330097","70189935037104495525897089633168244123","306576123403228771282968129054536480080","226714567186253957383971980360413508704","187989992647598380755570461639950930741","147354967674750052531737893602276117569"],"threshold":0.9},"id":"ASB-A-191382886-23870e76","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11","target":{"file":"services/core/java/com/android/server/ConnectivityService.java","function":"stopVpnProfile"},"deprecated":false,"digest":{"length":187,"function_hash":"218177222831341778865879455474855236138"},"id":"ASB-A-191382886-97b9e92f"},{"target":{"file":"services/core/java/com/android/server/ConnectivityService.java","function":"startVpnProfile"},"deprecated":false,"digest":{"function_hash":"340082255310276846879016599533391396102","length":214},"id":"ASB-A-191382886-ac7e74b8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191382886.json"}}],"schema_version":"1.9.0"}