CVE-2021-1032: Low severity Google Android vulnerability
In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-1032?
CVE-2021-1032 has been classified as a moderate severity vulnerability.
How do I fix CVE-2021-1032?
To fix CVE-2021-1032, ensure your Android device is updated to at least version 12.0 or later where the vulnerability is addressed.
What types of devices are affected by CVE-2021-1032?
CVE-2021-1032 affects devices running Android version 12.0.
What does CVE-2021-1032 expose?
CVE-2021-1032 may allow local information disclosure by determining if an app is installed without requiring query permissions.
Is user interaction required to exploit CVE-2021-1032?
No, user interaction is not required to exploit CVE-2021-1032.