CVE-2021-1010: Medium severity Google Android vulnerability
Published Dec 1, 2021
·Updated
In getSigningKeySet of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
2 affected componentsFixes available
Google Android=12.0
android/platform/frameworks/base>=12:0<12:2021-12-01
12:2021-12-01
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Dec 1, 2021
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Dec 15, 2021
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A local attacker with low privileges can exploit it. No user interaction or additional execution privileges are required.
2
What is the impact of successful exploitation?
Successful exploitation can disclose information locally. The provided data does not indicate integrity or availability impact.
3
Which Android versions are identified as affected?
The provided data identifies Android 12.