In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to the user due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{
"spl": "2021-05-05",
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819"
],
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": true,
"id": "ASB-A-119041698-036daab8",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "29472608375089826408637857411140459331",
"length": 2051.0
},
"target": {
"function": "createAutoGroupSummary",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-0a70974d",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"line_hashes": [
"191694645495675519573354045567764493555",
"170494914437267459320908987328288450066",
"264045177467590424870287705872140099919",
"269737990150308215043621670519876354803",
"145688581068961003577271275436012389074",
"32163582248344005832108534133936724048",
"25965682776163692576899563424569715093",
"267708305245113452024208228160191879244",
"96334015074375141721837460807282780131",
"146974132172315223065055322102661823761",
"174383483488551250567456768628019073316",
"29594650476139089397244925567329144834",
"61251447663224152815867371098399270866",
"253957524449123212217002696734556396436",
"41030024918405222190912052922620042659",
"165879146074943879495499890310309746245",
"122229600951538812187864180942825524513",
"83716782580873377859373439108313401893",
"12315128611033620598798975025277818603",
"205808893372679987645333217620742229352",
"122229600951538812187864180942825524513",
"52176671595526042826881153213450754711",
"168109611392457622650819118653694959879",
"119458344016581779589175067691921820069",
"131911534159360261804724978833519694609",
"243944813543307319380028584995967705896",
"281967097667654028372867533328461357128",
"99804636580894282869838289751986265230",
"58674954944278015276541494187369278125",
"261515190382452333347296779491757119377",
"10548659622825959672297017628094654005",
"257287824776743000158526105823914093807",
"170919190986040395865682338295964351791",
"44535676300685586789344842533020283718",
"333282809995125932145330252375183397468",
"232424158840758657911851122015534781945",
"230965216080703805343698180283929786070",
"49276659222775686385639843908659708025",
"311089271456746559043228145077642443227",
"239597025364151537193757181027211885230",
"259345226840039396416529209011464365676",
"69115019655017843105982901709517371468",
"37240430195358791798403626040163058481",
"212277189694184019648147530671022168576",
"288477094826432204723468316606777127839",
"260176120408576346610456644500400333922",
"138060863647387670698277204033839372149",
"242216034494277846445518222773526673379",
"240780899440622236429645966979156350123",
"34772431207795844502519191183656730376",
"24185972623305632179250566294401566678",
"142769964187606254222364357620229607649",
"267537437525102982886684438346254559316",
"327432973211588328538288480833942086275",
"230887476449681890245269444356303148736",
"220192777312601498695873340930733633959",
"331594832270513839380195784569627860809",
"317006001422722076604997984923610542153",
"149678305550489391431151146612749057460",
"110551161172824855329851045464969817653",
"111963589264841781924597680226802158962",
"264667718153999214730586782842818813034",
"218545438662065756775994557052322607497",
"77551972734520153775753332875121983656",
"77846546595456867998749512082820034742",
"192447782757784638557643439422339641436",
"245475733632191966291089080408991113003",
"291198323022900176639352550525555075826",
"293722565277839190954757317624548124736",
"69630651920148603740643319960407917557",
"260928084622265791285887346172094209692",
"129634131498445319661180393151678419283",
"167545017228289155753967203963865316224",
"274780881459521224916389064891223458966",
"19767264293563224681874298087760441374",
"293949540968280903538352693917672011553",
"316473828390802631319309338371437820123",
"70891204371756509125276479204009875427",
"313248997914977296232474205182891858752",
"247190815362044849848931655870682348979",
"11941493530324394547546005202565540615",
"146074563547627212305302765065756046325",
"62754697989551637874014637204304472403",
"111834304528125803281292823027024603014",
"33406716020306390361913064850279693728",
"235521963569938146080421402242829021114",
"154001825442791527020264217786111822265",
"249079258536509767474747677600495015024",
"323983618285966997895684482896287906410",
"212770441479837262291620952122322910763",
"227419933610601596271990633697037879344",
"36175142353258800144531335194398032023",
"253212345864198430316342053727243070554",
"107284947639086220661197660698554859292",
"267406980718808951045672813725817087841",
"228413945252246790217024536962231745666",
"294260487655895105171226218613613621195",
"38167789061195888705061435978961320968",
"174456172011125054776586526905232584903",
"311718160811752228276619021492717842139",
"1054937834579370635714446912479908932",
"97454439455241286033102472451801384378",
"97641493291496279833787109779107455074",
"189194489923130993724352102449283862406",
"214368195092498320454318052677710794949",
"92935132272159491292203068235773765633",
"32146460164111638627963438478116649155",
"150219927013723281777458300658708986591",
"153615853279523551788505566402144803610",
"4757081581636578029798457814686201680",
"273662422978699568208150585213160335208",
"274889216224878448536653598435860082075",
"208684913771109947734351304005271835013",
"97099195347685331891925984855780642293",
"270678942032900107532585927196689507259",
"258082748060012962958330257477986499301",
"325233640912430932546304516008741975712",
"71943605464745341673129503458162366687",
"228563602425560054208666224471461845",
"49203146040210516076141991225940765148",
"246691807673722872528664323955052864140",
"9943393937518818060823779106995627174",
"271770480696372607392659285881329151776",
"334992403155770668998608492899459599196",
"117774995754597450507047168051971916749",
"52772278527047793630504569032592157351",
"318076532103877074878438782323445036951",
"313017978442866824198781489833236531876",
"270019399270030944274901435147357221316",
"158610395389340269325907407944345227601",
"145891413274519238527010039735219397653",
"108587633537507210242609878158511307392",
"108587633537507210242609878158511307392",
"108587633537507210242609878158511307392",
"79158659676426694205688975482377806594",
"203965680306265212909576997574045184732",
"70317077184313754837410874676116369586",
"225837905362859806327732307040015506370",
"109271267899217838483746432127703437419",
"16056130487991361960702776912293997920",
"315716726906985463863376925693697161046",
"195673343554017707038915124719340741668",
"93222716033731902738855195272634723056",
"199522237290408759476235163879484196274",
"227452466193732628987024162899871862867",
"110642916805597306021229898008857490589",
"185865797579047743851433036038586494666",
"108587633537507210242609878158511307392",
"161463535799352356807588548993138589137",
"108134013665617874255735862588600449885",
"206435747356917152014814813439899523455",
"56065908399782956450602406188169792250",
"332241115234294860766877446837095458161",
"301937784832550342886503590140905867253",
"139225140698305934598092101840524747365",
"318998639563574692103000054942309974658",
"237925232703981494671319540275577881063",
"233978173801931884409956569922266577698",
"66067779178020905499414387430950377146",
"75407180318704451699303769443305508093",
"108587633537507210242609878158511307392",
"108587633537507210242609878158511307392",
"111346015065929017411823557318883026740",
"76067114145434449540644438042911312110",
"101550802567197085844428166667344773099",
"125611590728146499326559770857814272829",
"27692294240696747626655970865222335172",
"301639382810664994593252286174139214160",
"183538128415243348939302344105253521903",
"89530040573565970410529584486649809747",
"203226081654652196679389168428706953216",
"188234319422384658810773794864053098147",
"242659052188613679102989226268516327985",
"241290121157499598743573597257851418471",
"314996096479339125582147278283152570583",
"338782340117689711779118740876511848998",
"111069800744649795406676948013884897404",
"288774114731607398634864446538224374616",
"232815979227074370050992055143647441598",
"113704292944491503236890694919902122990"
],
"threshold": 0.9
},
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-20824d7f",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "319853082085305051186734760271746635426",
"length": 4656.0
},
"target": {
"function": "dumpImpl",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-43fe1f2b",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "179287887862317882097790086971511605017",
"length": 1745.0
},
"target": {
"function": "run",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-556fe884",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "295838265013854048266666937196561685652",
"length": 1907.0
},
"target": {
"function": "readPolicyXml",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-596abf2c",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "311667419936881194125575729460256509453",
"length": 3534.0
},
"target": {
"function": "run",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-5d9e1737",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "2982089058390772141788271800331699364",
"length": 1139.0
},
"target": {
"function": "onNotificationClick",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-67f79bec",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "148051447497407289059310803847325011811",
"length": 644.0
},
"target": {
"function": "CancelNotificationRunnable",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-6c9c05ed",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "4679512688626466174133925212477317438",
"length": 599.0
},
"target": {
"function": "scheduleTimeoutLocked",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"signature_version": "v1",
"match_only_versions": [
"11"
],
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"id": "ASB-A-119041698-710eaeb5",
"target": {
"function": "handleRankingReconsideration",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "38950330952184151308877828203957569280",
"length": 883.0
}
},
{
"deprecated": true,
"id": "ASB-A-119041698-86dcba53",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "222670727177651300411767989932756287862",
"length": 3031.0
},
"target": {
"function": "cancelNotificationLocked",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"signature_version": "v1",
"match_only_versions": [
"11"
],
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"id": "ASB-A-119041698-8c64bffb",
"target": {
"function": "run",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "200039775730620155494068589088137131726",
"length": 1952.0
}
},
{
"deprecated": true,
"id": "ASB-A-119041698-98c6da09",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "15535499056823068998113884943152686538",
"length": 209.0
},
"target": {
"function": "NotificationManagerService",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-9c85e836",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "154287128684923945405687423197846194748",
"length": 2164.0
},
"target": {
"function": "checkDisqualifyingFeatures",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-a98048bf",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "289377744740282322267939898146017035527",
"length": 1027.0
},
"target": {
"function": "maybeRecordInterruptionLocked",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-ae7a1ae4",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "125189707898485001832729354608499618406",
"length": 1192.0
},
"target": {
"function": "onBootPhase",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"id": "ASB-A-119041698-c0b728c7",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "264648862111828234493553173313251419686",
"length": 4604.0
},
"target": {
"function": "enqueueNotificationInternal",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": true,
"signature_version": "v1",
"match_only_versions": [
"11"
],
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"id": "ASB-A-119041698-c57fce43",
"target": {
"function": "NotificationManagerService",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "222825782879507962666947708234775844091",
"length": 112.0
}
},
{
"deprecated": true,
"id": "ASB-A-119041698-d202a501",
"source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819",
"digest": {
"function_hash": "266588313843957953467193973232415822000",
"length": 1373.0
},
"target": {
"function": "onNotificationActionClick",
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"signature_type": "Function",
"signature_version": "v1"
}
]
}