CVE-2021-0473: Google Android NFC RCE Vulnerability

CVE-2021-0473 Overview

CVE-2021-0473 is a critical double free vulnerability in the Android NFC (Near Field Communication) stack, specifically within the rw_t3t_process_error function of rw_t3t.cc. This vulnerability arises from uninitialized data handling during Type 3 Tag (T3T) NFC operations, which can lead to remote code execution when a malicious NFC tag is brought into proximity with a vulnerable Android device.

The vulnerability is particularly dangerous because it requires no user interaction and no additional execution privileges to exploit. An attacker within adjacent network range (NFC proximity) can trigger the double free condition, potentially gaining complete control over the affected Android device.

Critical Impact

Remote code execution over NFC without user interaction, allowing attackers to execute arbitrary code on vulnerable Android devices simply by being in NFC proximity.

Affected Products

• Google Android 8.1
• Google Android 9.0
• Google Android 10.0
• Google Android 11.0

Discovery Timeline

• 2021-05-01 - Google releases security patch in Android Security Bulletin May 2021
• 2021-06-11 - CVE-2021-0473 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-0473

Vulnerability Analysis

The vulnerability exists in the NFC Reader/Writer module for Type 3 Tags (T3T), which is commonly used in FeliCa-based NFC systems. The rw_t3t_process_error function in rw_t3t.cc fails to properly initialize data structures before use, leading to a double free condition when error handling code paths are triggered.

When processing malformed T3T responses or encountering error conditions during NFC communication, the uninitialized data can cause memory management functions to free the same memory block twice. This memory corruption primitive can be leveraged by attackers to achieve arbitrary code execution through heap manipulation techniques.

The attack vector being adjacent network (NFC proximity) means an attacker must be within approximately 10 centimeters of the target device. However, this attack requires no authentication, no user interaction, and executes with the privileges of the NFC service, which typically has elevated permissions on Android devices.

Root Cause

The root cause is CWE-908 (Use of Uninitialized Resource). The rw_t3t_process_error function does not properly initialize internal data structures before they are used in error handling code paths. When specific error conditions occur during T3T NFC tag processing, the uninitialized pointers or state variables can contain garbage values that lead to double free operations when cleanup routines execute.

This type of vulnerability often occurs in complex state machines like NFC protocol handlers, where multiple code paths can trigger cleanup operations, and proper initialization of all state variables across all entry points becomes challenging.

Attack Vector

The attack vector for CVE-2021-0473 is adjacent network access via NFC proximity. An attacker can exploit this vulnerability through the following attack scenario:

1. The attacker crafts a malicious NFC tag containing specially crafted T3T data
2. The attacker brings the malicious tag within NFC range of a vulnerable Android device
3. The Android NFC subsystem automatically attempts to read and process the tag
4. The malformed data triggers an error condition in rw_t3t_process_error
5. The uninitialized data causes a double free condition
6. The attacker leverages the memory corruption to achieve code execution

The exploitation does not require any user interaction—simply having NFC enabled and bringing a vulnerable device near the malicious tag is sufficient. This makes the vulnerability particularly dangerous in scenarios such as public transit, retail environments, or anywhere NFC transactions occur.

Detection Methods for CVE-2021-0473

Indicators of Compromise

• Unexpected NFC service crashes or restarts on Android devices
• Memory corruption signatures in system logs related to libnfc-nci or NFC subsystem components
• Anomalous behavior following NFC tag interactions, such as unexpected process spawning
• System instability or crashes when NFC-enabled devices are brought near unknown tags

Detection Strategies

• Monitor Android system logs for crashes or exceptions originating from rw_t3t.cc or related NFC components
• Implement mobile threat detection solutions capable of identifying memory corruption exploitation attempts
• Deploy endpoint detection that monitors for abnormal process behavior following NFC interactions
• Utilize SentinelOne Singularity Mobile to detect exploitation attempts and anomalous NFC activity

Monitoring Recommendations

• Enable verbose NFC logging on managed devices to capture detailed transaction data for forensic analysis
• Implement network-level monitoring for devices that may have been compromised via NFC exploitation
• Regularly audit Android device patch levels to ensure security updates are applied
• Monitor for unusual data exfiltration or command-and-control traffic from mobile devices

How to Mitigate CVE-2021-0473

Immediate Actions Required

• Apply the Android Security Bulletin May 2021 patches immediately to all affected devices
• Disable NFC functionality on devices that cannot be immediately patched
• Implement mobile device management (MDM) policies to enforce security patch compliance
• Educate users about the risks of using NFC on unpatched devices, especially in public environments

Patch Information

Google addressed this vulnerability in the Android Security Bulletin May 2021. The vulnerability is tracked internally by Google as Android ID: A-179687208. Organizations should ensure all Android devices running versions 8.1, 9, 10, and 11 are updated to security patch levels dated 2021-05-01 or later.

For enterprise environments, coordinate with device manufacturers (OEMs) to verify patch availability, as security updates may be distributed on different schedules depending on the device manufacturer and carrier.

Workarounds

• Disable NFC on vulnerable devices through Settings > Connected devices > Connection preferences > NFC
• Implement MDM policies to disable NFC functionality until patches can be applied
• Use SentinelOne Singularity Mobile for real-time threat detection and protection on managed mobile devices
• Restrict physical access to vulnerable devices in high-risk environments where malicious NFC tags may be present

# Android ADB command to check current security patch level
adb shell getprop ro.build.version.security_patch

# Verify NFC service status
adb shell dumpsys nfc | grep -i "enabled"

# Disable NFC via ADB (requires root)
adb shell settings put global nfc_on 0