CVE-2021-39802

What it actually does

Permissions bypass in kernel mprotect.c change_pte_range function that allows converting a shared mmap to writable without proper authorization checks.

Why it matters to the business

Local attackers on affected Android devices can elevate privileges without user interaction, increasing risk of unauthorized data access or system compromise on unpatched devices.

How an attack unfolds

A local process or application invokes mprotect on a shared mapping; the flawed change_pte_range logic permits the mapping to become writable, enabling the attacker to modify memory and execute elevated code.

How to fix it

Apply the upstream kernel patch referenced by Android ID A-213339151 and update to a patched Android kernel build that corrects the mprotect permissions logic.

How to confirm the fix worked

Confirm the device is running a kernel build that includes the fix for A-213339151; review kernel source for corrected change_pte_range handling and test that shared mappings retain intended permissions after mprotect calls.

Typical attack path

1. Obtain local code execution as a low-privileged user or app on an Android device
2. Map shared memory and call mprotect to trigger the vulnerable change_pte_range path
3. Bypass permission checks to make the mapping writable
4. Write malicious payloads into the now-writable region and execute with escalated privileges

How to detect it

Examine kernel logs and audit records for unusual mprotect calls on shared mappings; look for post-exploitation artifacts such as unexpected writable memory regions or privilege changes in process listings.

What your security team should do

• Prioritize patching Android devices with the upstream kernel fix for A-213339151
• Monitor for new Android security bulletins that include this issue
• Restrict local app execution privileges where possible until devices are updated