CVE-2021-1034: Low severity Google Android vulnerability
In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without querypermissions due to a missing permission check. This could lead to localinformation disclosure with no additional execution privileges needed. Userinteraction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-193441322
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12:2021-12-01
Event History
Frequently Asked Questions
What is the severity of CVE-2021-1034?
CVE-2021-1034 is classified as a moderate severity vulnerability.
How do I fix CVE-2021-1034?
Fixing CVE-2021-1034 requires updating your Android device to a patched version that addresses this vulnerability.
What type of information might be disclosed due to CVE-2021-1034?
CVE-2021-1034 may allow local information disclosure regarding installed applications on the device.
Who is affected by CVE-2021-1034?
CVE-2021-1034 affects devices running Android 12.0.
What component is vulnerable in CVE-2021-1034?
The vulnerability in CVE-2021-1034 resides in the PhoneInterfaceManager.java component.