{"id":"PUB-A-137395936","details":"In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access to restricted activities due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-137395936","CVE-2021-0571"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2021-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/520f1e7497b2edff3d54b069b793645d0462cf97"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2021-06-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2021-06-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["168002150002739841216163681226141405722","134001871090367896592995679405183435682","283649834669009943075993500140214384108","114919511681757600587125165555614849546","114653030879734487423729425510938145647","193153950767726930877298025010031967607","43013796217171146202320765303604346924","227627402932546077660412105895810201130","19431135875074681177035253269890888506","6223724284595797624969744586704819017","81028804551533510035655537728189580959","234036589339156461863573251643003819735","199178412494287388114426234181914176940","333812655541118583017039370273097657608","106048491485463350391552146488809079736","242542062537183986004743160777371014375","116861600944624206595352138524419053966","141259437422195616904197683218102837080","98838307943114504317127408193165359363","83034465256773543968021506380621518421","280028471372599161953508649678037209884","327396601696858655116338564557430422173","310899816281044323511827356622578188577","259584075024216973422030476753896896521","318633575271986805802308261958741120541","234430300070175370749896984302580761460","72017669765762045471399789468758354720","86624115491635204152577296465612142626","57526185528647667918831032746423539842","86142445396029018354743964988565470723","325773980409615731479113867071136096152","71277586342689198215765081214134941527","291345517644819558018070844493227363136","165031188565881914036238085846543761245","19977692656016183763499693955357607264","19817497052788510289881827690582395757","208711171370057405958858115622817774350","28940699634314466566677933179244131908","139283188740284109617514462172760883065","335705893273117451854106873336083371274","172163085932447417918153423968448758652","139462787242239230283410537744935645196","10274379875322417555391465675032443200","243996385574188928806559481022308848613","101822015306538523202976457563094609113","203636046537379567860966860993609848614","17330832262448084772890648158432335687","156243692270266840056286420696080258484","319597564788803758434277946181257877426","237928208965721304393823713237712991326","67178514010594455736009144185633139761","72573199499557185085811452661577632279","258803872203363228126800201592579905026","316299419311655281772991813172702462563","324227669740738292927336668891907747053","111208634022797067511504793178577429426","209093672196453915466636530611796975990"],"threshold":0.9},"id":"PUB-A-137395936-05adeb70"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"getAppTasks","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"141233750278356415247477638360520126934","length":236},"id":"PUB-A-137395936-18a75224","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"startActivityWithConfig","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"165007624212950936217783718510644541515","length":616},"id":"PUB-A-137395936-26dc1f97"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"startActivity","file":"services/core/java/com/android/server/wm/AppTaskImpl.java"},"deprecated":false,"digest":{"function_hash":"254454828739398420494681918754895712925","length":718},"id":"PUB-A-137395936-3222e099","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7","target":{"file":"services/core/java/com/android/server/UiModeManagerService.java","function":"sendConfigurationAndStartDreamOrDockAppLocked"},"deprecated":false,"digest":{"function_hash":"80683627543310294240949723430925264010","length":804},"id":"PUB-A-137395936-33706f35","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startActivityAsUser"},"deprecated":false,"digest":{"function_hash":"249945443157976983372054761248010022287","length":641},"id":"PUB-A-137395936-3d83cf43","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"startActivitiesInPackage","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"104230171459412815452588875810047418045","length":352},"id":"PUB-A-137395936-46745310","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startAssistantActivity"},"deprecated":false,"digest":{"length":481,"function_hash":"20502195857860504595551690392692331820"},"id":"PUB-A-137395936-775d08e9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/AppTaskImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329362196407775060224646270381045210596","114373874547952663955307802600237323298","178986866803594840573537345460715833823","143284661680706795474613429432547941490","250527303051710343006063998433446126061","27433135051089293122746371569790755495","325378707303461159989147193797744898228","54842175945111109135017946979309559893","318681472263896023882156917364221137030","19977692656016183763499693955357607264","195457493475686173427436862703363886531","1022028090547309964183528961917947844","38945781856767510718860027758718514511","131021580069016129519827063581373766153","69859918373355420808766785637849396468","232632413166406318650229108009220327108","247746510270556502795020643616815958216"]},"id":"PUB-A-137395936-78ca0c23","signature_type":"Line"},{"target":{"function":"startActivities","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"319391820664263321493639708659641833507","length":421},"id":"PUB-A-137395936-861ac77a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"},{"deprecated":false,"digest":{"function_hash":"92357934167385911137102987977524032055","length":666},"id":"PUB-A-137395936-8faf12d1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startActivityAndWait"}},{"target":{"file":"services/core/java/com/android/server/UiModeManagerService.java"},"deprecated":false,"digest":{"line_hashes":["120133855072458302708880813791042757129","313377708358512695002429498442777546195","198653262975074420650704456818989273425","97105502174761260707753732152002318771","135779943471888418407536876270755124417"],"threshold":0.9},"id":"PUB-A-137395936-bc0ae433","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startVoiceActivity"},"deprecated":false,"digest":{"length":705,"function_hash":"81279417598857111710546957814737053060"},"id":"PUB-A-137395936-becc705e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f"},{"deprecated":false,"digest":{"line_hashes":["66749074526194242030944232447760428162","17459012581173878130978390013546608566","83976425293805186350994445804737817211","272950675460115238438366488829158775001","302648306616857165946800382045739521614","248081305242231474049293081813798928776","30446384021628305209843556498497096154","255776652827034237454716963463250172764"],"threshold":0.9},"id":"PUB-A-137395936-c3fa2d62","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7","target":{"file":"services/core/java/com/android/server/policy/PhoneWindowManager.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/ActivityStackSupervisor.java"},"deprecated":false,"digest":{"line_hashes":["265417339396258012684593381357532180899","15210335708124496907401137095957383270","27605101375669741956055703004038240797","256924176236647211266048454880562547422"],"threshold":0.9},"id":"PUB-A-137395936-d09c9a8a","signature_type":"Line"},{"digest":{"length":1165,"function_hash":"315949899020848254423689844796501465554"},"id":"PUB-A-137395936-e21db41f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7","target":{"file":"services/core/java/com/android/server/policy/PhoneWindowManager.java","function":"goHome"},"deprecated":false},{"digest":{"function_hash":"337749010423866867468838380460361667694","length":1088},"id":"PUB-A-137395936-e75013ba","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"getActionRestrictionForCallingPackage","file":"services/core/java/com/android/server/wm/ActivityStackSupervisor.java"},"deprecated":false},{"id":"PUB-A-137395936-f1798eac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"moveTaskToFrontLocked"},"deprecated":false,"digest":{"length":1506,"function_hash":"264031356635378254347255764229287469093"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"function":"startActivityInPackage","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"84510986583101754706421048430227129944","length":462},"id":"PUB-A-137395936-f6ea12dd"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","target":{"file":"services/core/java/com/android/server/wm/AppTaskImpl.java","function":"moveToFront"},"deprecated":false,"digest":{"function_hash":"203228634119653363759680835009376471065","length":953},"id":"PUB-A-137395936-f77a1b86","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f9e5c9fe4671813043385406dd9a49b3b9d0d89f","https://android.googlesource.com/platform/frameworks/base/+/9e0a751edb761e1acd51893ecb154844073a35d7","https://android.googlesource.com/platform/frameworks/base/+/520f1e7497b2edff3d54b069b793645d0462cf97"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-137395936.json"}}],"schema_version":"1.9.0"}