CVE-2021-1018: Low severity Google Android vulnerability
In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-1018?
CVE-2021-1018 has a severity rating of medium due to potential information disclosure.
How do I fix CVE-2021-1018?
To mitigate CVE-2021-1018, users should update their Android devices to the latest security patch available.
What impact does CVE-2021-1018 have on user privacy?
CVE-2021-1018 could lead to local information disclosure by revealing if certain apps are installed without requiring query permissions.
Which versions of Android are affected by CVE-2021-1018?
CVE-2021-1018 specifically affects Android version 12.0.
Is user interaction required to exploit CVE-2021-1018?
No, user interaction is not required for the exploitation of CVE-2021-1018.