CVE-2021-0990: App can query installed applications without QUERY_ALL_PACKAGES permission
Summary
CVE-2021-0990: In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Affects platform/frameworks/opt/telephony versions >= 12:0, < 12:2021-12-01. Fixed in 12:2021-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is platform/frameworks/opt/telephony in the Android ecosystem. This package is responsible for handling telephony-related functionalities on Android devices. It includes classes and methods that provide access to phone-related information and services. The vulnerability in this package allows an app to query which applications are installed on the device without requiring the QUERY_ALL_PACKAGES permission.
Vulnerability Detail
The vulnerability exists in the getDeviceId function of the PhoneSubInfoController.java file. It allows an app to determine whether another app is installed on the device without the necessary query permissions. This information disclosure can lead to local information exposure without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction.
How To Fix
Minimum fixed version
12:2021-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the platform/frameworks/opt/telephony package allows an app to query installed applications without requiring the QUERY_ALL_PACKAGES permission. This can result in local information disclosure. Developers should update their applications to use the fixed version of the package to mitigate this vulnerability.
See every vulnerability recorded for platform/frameworks/opt/telephony →
FAQ
The vulnerability allows an app to determine whether another app is installed on the device without the necessary permissions. This can lead to local information disclosure.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability was introduced in version 12:0 and fixed in version 12:2021-12-01 of the package.
Yes, a fix has been released in version 12:2021-12-01 of the package. Developers should update their applications to use the fixed version.
More information about this vulnerability can be found in the source provided: https://storage.googleapis.com/android-osv/PUB-A-185591180.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/opt/telephony.
