{"id":"ASB-A-191382886","details":"In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWAYS_ON_VPN with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-191382886","CVE-2021-0649"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2021-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/591e345fbc0ccb6815e27ccff1a0ae9d02002a90"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Connectivity/+/a9ef5a9252761c73959cfb16a838d3c61fee77f3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-11-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/ConnectivityService.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["249075278512829168754042795387518813750","159388925239194086110019053960304969612","104848444477519217474237556570055385811","97590697546115221432188778181145799833","95975522758785182856088401938732163268","38729615384395579501124902717966760349","40135872218419544498134803688603443737","178413717962493023367993335606776715959","246714061973602262374419698083005330097","70189935037104495525897089633168244123","306576123403228771282968129054536480080","226714567186253957383971980360413508704","187989992647598380755570461639950930741","147354967674750052531737893602276117569"]},"signature_version":"v1","deprecated":false,"id":"ASB-A-191382886-23870e76","source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11"},{"id":"ASB-A-191382886-97b9e92f","target":{"function":"stopVpnProfile","file":"services/core/java/com/android/server/ConnectivityService.java"},"digest":{"length":187,"function_hash":"218177222831341778865879455474855236138"},"source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11","deprecated":false,"signature_version":"v1","signature_type":"Function"},{"id":"ASB-A-191382886-ac7e74b8","target":{"function":"startVpnProfile","file":"services/core/java/com/android/server/ConnectivityService.java"},"digest":{"length":214,"function_hash":"340082255310276846879016599533391396102"},"source":"https://android.googlesource.com/platform/frameworks/base/+/f3072fcd46112bad7c5f6ddd4cc35d2c67f00d11","deprecated":false,"signature_version":"v1","signature_type":"Function"}],"types":["EoP"],"severity":"High","spl":"2021-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191382886.json"}}],"schema_version":"1.7.5"}