CVE-2021-1012: Medium severity Google Android vulnerability
In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/apps/Settingsto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
What is CVE-2021-1012?
CVE-2021-1012 is a vulnerability in the Android operating system that allows an app to determine if another app is installed without proper permissions.
How severe is CVE-2021-1012?
CVE-2021-1012 has a severity rating of medium with a score of 5.5 out of 10.
Which version of Android is affected by CVE-2021-1012?
Android version 12.0 is affected by CVE-2021-1012.
How can CVE-2021-1012 be exploited?
CVE-2021-1012 can be exploited by an app to determine if another app is installed without proper permissions.
Is user interaction required to exploit CVE-2021-1012?
No, user interaction is not required to exploit CVE-2021-1012.