CVE-2021-0303
📋 TL;DR
This CVE describes a use-after-free vulnerability in Android's Car ComputePipe service due to a race condition in dispatchGraphTerminationMessage(). It allows local privilege escalation from user privileges to higher system privileges without requiring user interaction. Only Android 11 devices with the Car ComputePipe service are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full system control over the Android device, potentially compromising all user data, installing persistent malware, or using the device as a foothold for further attacks.
Likely Case
Local attacker escalates privileges to gain access to protected system resources, sensitive data, or install malicious applications with elevated permissions.
If Mitigated
With proper security controls like SELinux enforcement and minimal privilege applications, impact is limited to the compromised process's context.
🎯 Exploit Status
Exploitation requires winning a race condition and bypassing Android's security mitigations like ASLR and SELinux.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Patch Level 2021-01-01 or later
Vendor Advisory: https://source.android.com/security/bulletin/2021-01-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > Advanced > System update. 2. Install the January 2021 security patch or later. 3. Reboot the device after installation.
🔧 Temporary Workarounds
Disable Car ComputePipe Service
androidDisable the vulnerable service if not needed (may break automotive functionality)
adb shell pm disable com.android.car.computepipe
🧯 If You Can't Patch
- Restrict physical access to devices and implement application allowlisting
- Monitor for suspicious privilege escalation attempts using Android security logging
🔍 How to Verify
Check if Vulnerable:
Check Android version and security patch level: Settings > About phone > Android version and Security patch levelCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Security patch level is 2021-01-01 or later and Car ComputePipe service version is updated📡 Detection & Monitoring
Log Indicators:
- SELinux denials related to Car ComputePipe service
- Unexpected privilege escalation attempts in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="android_system" AND (process="computepipe" OR message="use-after-free")