CVE-2021-0430
📋 TL;DR
This vulnerability allows remote code execution via malicious NFC packets without requiring user interaction or additional privileges. An out-of-bounds write in the Android NFC stack could be exploited to execute arbitrary code on affected devices. All Android devices running versions 10 or 11 with NFC enabled are potentially affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install malware, steal data, or join device to botnet
Likely Case
Remote code execution leading to data theft, surveillance, or ransomware deployment
If Mitigated
Limited impact if NFC is disabled or device is patched, though physical proximity is still required
🎯 Exploit Status
Exploitation requires physical proximity to NFC range (~4 inches). No authentication or user interaction needed once in range.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Bulletin April 2021 patches
Vendor Advisory: https://source.android.com/security/bulletin/2021-04-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > Advanced > System update. 2. Install April 2021 security patch or later. 3. Restart device after installation.
🔧 Temporary Workarounds
Disable NFC
androidTurn off NFC functionality to prevent exploitation
Settings > Connected devices > Connection preferences > NFC > Toggle OFF
🧯 If You Can't Patch
- Disable NFC functionality completely
- Implement physical security controls to prevent unauthorized NFC devices near vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If version is 10 or 11 and security patch level is before April 2021, device is vulnerable.Check Version:
Settings > About phone > Android version and Android security patch levelVerify Fix Applied:
Verify security patch level is April 2021 or later in Settings > About phone > Android security patch level📡 Detection & Monitoring
Log Indicators:
- Unusual NFC activity logs
- Multiple failed NFC handshake attempts
- Unexpected NFC tag reads
Network Indicators:
- N/A - local attack only
SIEM Query:
N/A - requires physical proximity detection rather than network monitoring