CVE-2021-0934: Google Android DOS Vulnerability

CVE-2021-0934 Overview

A denial of service vulnerability exists in the findAllDeAccounts method of AccountsDb.java in Android's Account Management framework. This flaw allows a local attacker to exhaust system resources, causing a denial of service condition on affected Android devices. The vulnerability can be exploited without any special execution privileges and requires no user interaction, making it a significant threat to device availability.

Critical Impact

Local denial of service through resource exhaustion in Android's account management system, affecting devices running Android 10 through Android 13.

Affected Products

• Google Android 10.0
• Google Android 11.0
• Google Android 12.0 / 12L (12.1)
• Google Android 13.0

Discovery Timeline

• 2022-12-13 - CVE CVE-2021-0934 published to NVD
• 2025-04-22 - Last updated in NVD database

Technical Details for CVE-2021-0934

Vulnerability Analysis

This vulnerability resides in the findAllDeAccounts function within AccountsDb.java, which is part of Android's account management subsystem. The flaw is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating that the function fails to properly validate or limit the quantity of data it processes.

When invoked, the findAllDeAccounts method does not implement adequate bounds checking or resource consumption limits. This allows a malicious application or process to trigger the function in a way that causes excessive resource consumption, ultimately leading to system instability or unresponsiveness. The attack is local in nature, meaning the attacker must have code execution capability on the device, but no elevated privileges are required.

Root Cause

The root cause of this vulnerability is improper validation of specified quantities in input handling within the findAllDeAccounts method. The function does not adequately restrict the amount of resources it can consume when processing account data, leading to resource exhaustion conditions. This lack of input validation allows unbounded memory or processing operations that can deplete system resources.

Attack Vector

The attack vector is local, requiring the attacker to have the ability to execute code on the target Android device. This could be achieved through:

1. A malicious application installed on the device
2. Exploitation of another vulnerability that grants local code execution
3. A compromised legitimate application

Once the attacker has local access, they can invoke the vulnerable function repeatedly or with crafted input to exhaust system resources. No user interaction is required for successful exploitation, meaning the attack can occur silently in the background without any indication to the device user.

The vulnerability mechanism involves improper resource management in the findAllDeAccounts method within AccountsDb.java. The function queries device-encrypted account storage without implementing proper resource limits, allowing unbounded memory allocation or excessive CPU consumption. For full technical details, see the Android Security Bulletin December 2022.

Detection Methods for CVE-2021-0934

Indicators of Compromise

• Abnormal resource consumption by system account services or AccountManagerService
• Device unresponsiveness or slowdowns related to account synchronization operations
• Crash logs showing resource exhaustion in AccountsDb.java or related account management components
• Unusual activity patterns from applications repeatedly accessing account management APIs

Detection Strategies

• Monitor system logs for excessive calls to account management functions or AccountsDb operations
• Implement mobile device management (MDM) solutions to track resource utilization anomalies
• Deploy application sandboxing to detect and contain apps exhibiting unusual API call patterns
• Analyze installed applications for suspicious account management API usage patterns

Monitoring Recommendations

• Enable Android system logging to capture account management subsystem activity
• Configure alerting for system service crashes or restarts related to AccountManagerService
• Monitor device battery and memory consumption for unusual patterns indicating resource exhaustion
• Use SentinelOne Mobile Threat Defense to detect anomalous application behavior targeting system services

How to Mitigate CVE-2021-0934

Immediate Actions Required

• Update affected Android devices to the latest security patch level (December 2022 or later)
• Review installed applications and remove any suspicious or untrusted apps
• Enable Google Play Protect to scan for potentially harmful applications
• Consider restricting app installations from unknown sources

Patch Information

Google addressed this vulnerability in the Android Security Bulletin December 2022. The security patch implements proper resource validation and limits in the findAllDeAccounts method to prevent resource exhaustion attacks. Organizations should ensure all managed Android devices receive the December 2022 security update (patch level 2022-12-01 or later).

Workarounds

• Limit application installation to trusted sources only (Google Play Store)
• Deploy enterprise mobility management (EMM) solutions to enforce security policies
• Monitor device health and performance for early detection of denial of service conditions
• Consider device segmentation for high-value targets to limit impact of potential exploitation

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output should be 2022-12-01 or later to include this fix