CVE-2021-1008: Medium severity Google Android vulnerability
Published Dec 1, 2021
·Updated
In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.
Affected Software
2 affected componentsFixes available
Google Android=12.0
android/platform/frameworks/opt/telephony>=12:0<12:2021-12-01
12:2021-12-01
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/opt/telephonyto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Dec 1, 2021
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Dec 15, 2021
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs local access and System execution privileges. No user interaction is required.
2
What is the practical impact?
Successful exploitation can cause a local denial of service by forcing the device to perform a factory reset.
3
Which Android version is identified as affected?
The provided data identifies Android 12.