CVE-2021-1011: Medium severity Google Android vulnerability

Q: What is CVE-2021-1011?

CVE-2021-1011 is a vulnerability in setPackageStoppedState of PackageManagerService.java in Android 12.0 that allows for local information disclosure without additional execution privileges.

Q: How severe is CVE-2021-1011?

CVE-2021-1011 has a severity rating of medium with a CVSS score of 5.5.

Q: How can CVE-2021-1011 be exploited?

CVE-2021-1011 can be exploited without user interaction.

Q: Is there a patch available for CVE-2021-1011?

Yes, a patch is available. It is recommended to update to the latest version of Android to fix this vulnerability.

Q: Where can I find more information about CVE-2021-1011?

More information about CVE-2021-1011 can be found in the Android security bulletin for December 2021.

Published Dec 1, 2021

Updated

In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

2 affected componentsFixes available

Google Android=12.0

android/platform/frameworks/base>=12:0<12:2021-12-01

12:2021-12-01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 12:2021-12-01

Event History

Dec 1, 2021

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Dec 15, 2021

CVE Published

via MITRE·06:06 PM

Data Sourced

via MITRE·06:06 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-1011?

CVE-2021-1011 is a vulnerability in setPackageStoppedState of PackageManagerService.java in Android 12.0 that allows for local information disclosure without additional execution privileges.

How severe is CVE-2021-1011?