CVE-2021-0956
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Android devices via NFC communication without user interaction. It affects Android 11 and 12 devices with NFC hardware enabled. The out-of-bounds write in the NFC stack could lead to privilege escalation.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install malware, steal data, or gain persistent access to the device.
Likely Case
Remote code execution leading to data theft, surveillance, or device takeover when NFC is enabled and in proximity to malicious NFC tags.
If Mitigated
Limited impact if NFC is disabled or device is not in proximity to malicious NFC sources.
🎯 Exploit Status
Exploitation requires proximity to malicious NFC tag/reader. No authentication needed for initial attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Bulletin December 2021 patches
Vendor Advisory: https://source.android.com/security/bulletin/2021-12-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install Android Security Patch Level December 2021 or later. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable NFC
androidTurn off NFC functionality to prevent exploitation via malicious NFC tags
Settings > Connected devices > Connection preferences > NFC > Toggle OFF
🧯 If You Can't Patch
- Disable NFC functionality completely in device settings
- Restrict physical access to devices and avoid unknown NFC sources
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If version is 11 or 12 with patch level before December 2021, device is vulnerable.Check Version:
adb shell getprop ro.build.version.release && adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android Security Patch Level is December 2021 or later in Settings > About phone > Android security update📡 Detection & Monitoring
Log Indicators:
- Unusual NFC activity logs
- System crashes in NFC service
- Privilege escalation attempts
Network Indicators:
- N/A - local proximity attack
SIEM Query:
N/A - primarily physical proximity attack