CVE-2021-0644: Infoleak

Q: Who can exploit this issue?

An attacker needs local execution with User privileges. No user interaction is required.

Q: What information could be exposed?

The issue could allow retrieval of a trackable identifier, resulting in local information disclosure. The provided data does not indicate integrity or availability impact.

Q: Which Android versions are listed as affected?

Android 10 and Android 11 are listed.

Q: How can I determine whether a device may be affected?

Check whether the device runs Android 10 or Android 11 and whether its framework and telephony components include the permission-check fixes referenced for SubscriptionController.java.

Published Sep 1, 2021

Updated

In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected componentsFixes available

Google Android=10.0

Google Android=11.0

Google Android

android/platform/frameworks/base>=10:0<10:2021-09-01

10:2021-09-01

android/platform/frameworks/opt/telephony>=10:0<10:2021-09-01

10:2021-09-01

android/platform/frameworks/base>=11:0<11:2021-09-01

11:2021-09-01

android/platform/frameworks/opt/telephony>=11:0<11:2021-09-01

11:2021-09-01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 10:2021-09-01
Upgrade
Upgrade android/platform/frameworks/opt/telephony to a version that resolves this vulnerability.
Fixed in 10:2021-09-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 11:2021-09-01
Upgrade
Upgrade android/platform/frameworks/opt/telephony to a version that resolves this vulnerability.
Fixed in 11:2021-09-01

Event History

Sep 1, 2021

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Sep 7, 2021

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Oct 6, 2021

CVE Published

via MITRE·02:11 PM

Data Sourced

via MITRE·02:11 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local execution with User privileges. No user interaction is required.

What information could be exposed?

The issue could allow retrieval of a trackable identifier, resulting in local information disclosure. The provided data does not indicate integrity or availability impact.

Which Android versions are listed as affected?

Android 10 and Android 11 are listed.

How can I determine whether a device may be affected?

Check whether the device runs Android 10 or Android 11 and whether its framework and telephony components include the permission-check fixes referenced for SubscriptionController.java.

CVE-2021-0644: Infoleak

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which Android versions are listed as affected?

How can I determine whether a device may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which Android versions are listed as affected?

How can I determine whether a device may be affected?