CVE-2021-1004
📋 TL;DR
This vulnerability in Android 12's Wi-Fi service allows local attackers to detect whether specific apps are installed without proper permissions. It enables local privilege escalation without requiring user interaction. Only Android 12 devices are affected.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Attackers could combine this information disclosure with other vulnerabilities to achieve full device compromise or targeted attacks against specific app users.
Likely Case
Attackers can profile user's installed applications for targeted phishing, social engineering, or reconnaissance for further attacks.
If Mitigated
With proper patching, the vulnerability is eliminated; without patching, risk is limited to local attackers with physical or malware access.
🎯 Exploit Status
Exploitation requires local access but no special permissions. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Update December 2021 or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2021-12-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install the December 2021 security update or later. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable Wi-Fi when not needed
androidReduces attack surface by disabling the vulnerable service when not in use
Settings > Network & internet > Wi-Fi > Toggle off
🧯 If You Can't Patch
- Restrict physical access to devices and monitor for suspicious apps
- Use mobile device management (MDM) to enforce security policies and app whitelisting
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If it shows Android 12 without December 2021 security patch, device is vulnerable.Check Version:
adb shell getprop ro.build.version.release && adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android version is 12 with security patch level December 2021 or later in Settings > About phone > Android security update.📡 Detection & Monitoring
Log Indicators:
- Unusual Wi-Fi service calls from unprivileged apps
- Multiple failed permission checks in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
source="android_system" AND (event="WifiServiceImpl" OR event="getConfiguredNetworks") AND user!=system