In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to the user due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{ "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" ], "vanir_signatures": [ { "id": "ASB-A-119041698-036daab8", "signature_type": "Function", "deprecated": true, "target": { "function": "createAutoGroupSummary", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 2051.0, "function_hash": "29472608375089826408637857411140459331" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-0a70974d", "signature_type": "Line", "deprecated": true, "target": { "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "threshold": 0.9, "line_hashes": [ "191694645495675519573354045567764493555", "170494914437267459320908987328288450066", "264045177467590424870287705872140099919", "269737990150308215043621670519876354803", "145688581068961003577271275436012389074", "32163582248344005832108534133936724048", "25965682776163692576899563424569715093", "267708305245113452024208228160191879244", "96334015074375141721837460807282780131", "146974132172315223065055322102661823761", "174383483488551250567456768628019073316", "29594650476139089397244925567329144834", "61251447663224152815867371098399270866", "253957524449123212217002696734556396436", "41030024918405222190912052922620042659", "165879146074943879495499890310309746245", "122229600951538812187864180942825524513", "83716782580873377859373439108313401893", "12315128611033620598798975025277818603", "205808893372679987645333217620742229352", "122229600951538812187864180942825524513", "52176671595526042826881153213450754711", "168109611392457622650819118653694959879", "119458344016581779589175067691921820069", "131911534159360261804724978833519694609", "243944813543307319380028584995967705896", "281967097667654028372867533328461357128", "99804636580894282869838289751986265230", "58674954944278015276541494187369278125", "261515190382452333347296779491757119377", "10548659622825959672297017628094654005", "257287824776743000158526105823914093807", "170919190986040395865682338295964351791", "44535676300685586789344842533020283718", "333282809995125932145330252375183397468", "232424158840758657911851122015534781945", "230965216080703805343698180283929786070", "49276659222775686385639843908659708025", "311089271456746559043228145077642443227", "239597025364151537193757181027211885230", "259345226840039396416529209011464365676", "69115019655017843105982901709517371468", "37240430195358791798403626040163058481", "212277189694184019648147530671022168576", "288477094826432204723468316606777127839", "260176120408576346610456644500400333922", "138060863647387670698277204033839372149", "242216034494277846445518222773526673379", "240780899440622236429645966979156350123", "34772431207795844502519191183656730376", "24185972623305632179250566294401566678", "142769964187606254222364357620229607649", "267537437525102982886684438346254559316", "327432973211588328538288480833942086275", "230887476449681890245269444356303148736", "220192777312601498695873340930733633959", "331594832270513839380195784569627860809", "317006001422722076604997984923610542153", "149678305550489391431151146612749057460", "110551161172824855329851045464969817653", "111963589264841781924597680226802158962", "264667718153999214730586782842818813034", "218545438662065756775994557052322607497", "77551972734520153775753332875121983656", "77846546595456867998749512082820034742", "192447782757784638557643439422339641436", "245475733632191966291089080408991113003", "291198323022900176639352550525555075826", "293722565277839190954757317624548124736", "69630651920148603740643319960407917557", "260928084622265791285887346172094209692", "129634131498445319661180393151678419283", "167545017228289155753967203963865316224", "274780881459521224916389064891223458966", "19767264293563224681874298087760441374", "293949540968280903538352693917672011553", "316473828390802631319309338371437820123", "70891204371756509125276479204009875427", "313248997914977296232474205182891858752", "247190815362044849848931655870682348979", "11941493530324394547546005202565540615", "146074563547627212305302765065756046325", "62754697989551637874014637204304472403", "111834304528125803281292823027024603014", "33406716020306390361913064850279693728", "235521963569938146080421402242829021114", "154001825442791527020264217786111822265", "249079258536509767474747677600495015024", "323983618285966997895684482896287906410", "212770441479837262291620952122322910763", "227419933610601596271990633697037879344", "36175142353258800144531335194398032023", "253212345864198430316342053727243070554", "107284947639086220661197660698554859292", "267406980718808951045672813725817087841", "228413945252246790217024536962231745666", "294260487655895105171226218613613621195", "38167789061195888705061435978961320968", "174456172011125054776586526905232584903", "311718160811752228276619021492717842139", "1054937834579370635714446912479908932", "97454439455241286033102472451801384378", "97641493291496279833787109779107455074", "189194489923130993724352102449283862406", "214368195092498320454318052677710794949", "92935132272159491292203068235773765633", "32146460164111638627963438478116649155", "150219927013723281777458300658708986591", "153615853279523551788505566402144803610", "4757081581636578029798457814686201680", "273662422978699568208150585213160335208", "274889216224878448536653598435860082075", "208684913771109947734351304005271835013", "97099195347685331891925984855780642293", "270678942032900107532585927196689507259", "258082748060012962958330257477986499301", "325233640912430932546304516008741975712", "71943605464745341673129503458162366687", "228563602425560054208666224471461845", "49203146040210516076141991225940765148", "246691807673722872528664323955052864140", "9943393937518818060823779106995627174", "271770480696372607392659285881329151776", "334992403155770668998608492899459599196", "117774995754597450507047168051971916749", "52772278527047793630504569032592157351", "318076532103877074878438782323445036951", "313017978442866824198781489833236531876", "270019399270030944274901435147357221316", "158610395389340269325907407944345227601", "145891413274519238527010039735219397653", "108587633537507210242609878158511307392", "108587633537507210242609878158511307392", "108587633537507210242609878158511307392", "79158659676426694205688975482377806594", "203965680306265212909576997574045184732", "70317077184313754837410874676116369586", "225837905362859806327732307040015506370", "109271267899217838483746432127703437419", "16056130487991361960702776912293997920", "315716726906985463863376925693697161046", "195673343554017707038915124719340741668", "93222716033731902738855195272634723056", "199522237290408759476235163879484196274", "227452466193732628987024162899871862867", "110642916805597306021229898008857490589", "185865797579047743851433036038586494666", "108587633537507210242609878158511307392", "161463535799352356807588548993138589137", "108134013665617874255735862588600449885", "206435747356917152014814813439899523455", "56065908399782956450602406188169792250", "332241115234294860766877446837095458161", "301937784832550342886503590140905867253", "139225140698305934598092101840524747365", "318998639563574692103000054942309974658", "237925232703981494671319540275577881063", "233978173801931884409956569922266577698", "66067779178020905499414387430950377146", "75407180318704451699303769443305508093", "108587633537507210242609878158511307392", "108587633537507210242609878158511307392", "111346015065929017411823557318883026740", "76067114145434449540644438042911312110", "101550802567197085844428166667344773099", "125611590728146499326559770857814272829", "27692294240696747626655970865222335172", "301639382810664994593252286174139214160", "183538128415243348939302344105253521903", "89530040573565970410529584486649809747", "203226081654652196679389168428706953216", "188234319422384658810773794864053098147", "242659052188613679102989226268516327985", "241290121157499598743573597257851418471", "314996096479339125582147278283152570583", "338782340117689711779118740876511848998", "111069800744649795406676948013884897404", "288774114731607398634864446538224374616", "232815979227074370050992055143647441598", "113704292944491503236890694919902122990" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-20824d7f", "signature_type": "Function", "deprecated": true, "target": { "function": "dumpImpl", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 4656.0, "function_hash": "319853082085305051186734760271746635426" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-43fe1f2b", "signature_type": "Function", "deprecated": true, "target": { "function": "run", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1745.0, "function_hash": "179287887862317882097790086971511605017" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-556fe884", "signature_type": "Function", "deprecated": true, "target": { "function": "readPolicyXml", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1907.0, "function_hash": "295838265013854048266666937196561685652" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-596abf2c", "signature_type": "Function", "deprecated": true, "target": { "function": "run", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 3534.0, "function_hash": "311667419936881194125575729460256509453" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-5d9e1737", "signature_type": "Function", "deprecated": true, "target": { "function": "onNotificationClick", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1139.0, "function_hash": "2982089058390772141788271800331699364" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-67f79bec", "signature_type": "Function", "deprecated": true, "target": { "function": "CancelNotificationRunnable", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 644.0, "function_hash": "148051447497407289059310803847325011811" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-6c9c05ed", "signature_type": "Function", "deprecated": true, "target": { "function": "scheduleTimeoutLocked", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 599.0, "function_hash": "4679512688626466174133925212477317438" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-710eaeb5", "deprecated": true, "digest": { "length": 883.0, "function_hash": "38950330952184151308877828203957569280" }, "match_only_versions": [ "11" ], "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819", "signature_type": "Function", "target": { "function": "handleRankingReconsideration", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "signature_version": "v1" }, { "id": "ASB-A-119041698-86dcba53", "signature_type": "Function", "deprecated": true, "target": { "function": "cancelNotificationLocked", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 3031.0, "function_hash": "222670727177651300411767989932756287862" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-8c64bffb", "deprecated": true, "digest": { "length": 1952.0, "function_hash": "200039775730620155494068589088137131726" }, "match_only_versions": [ "11" ], "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819", "signature_type": "Function", "target": { "function": "run", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "signature_version": "v1" }, { "id": "ASB-A-119041698-98c6da09", "signature_type": "Function", "deprecated": true, "target": { "function": "NotificationManagerService", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 209.0, "function_hash": "15535499056823068998113884943152686538" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-9c85e836", "signature_type": "Function", "deprecated": true, "target": { "function": "checkDisqualifyingFeatures", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 2164.0, "function_hash": "154287128684923945405687423197846194748" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-a98048bf", "signature_type": "Function", "deprecated": true, "target": { "function": "maybeRecordInterruptionLocked", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1027.0, "function_hash": "289377744740282322267939898146017035527" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-ae7a1ae4", "signature_type": "Function", "deprecated": true, "target": { "function": "onBootPhase", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1192.0, "function_hash": "125189707898485001832729354608499618406" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-c0b728c7", "signature_type": "Function", "deprecated": true, "target": { "function": "enqueueNotificationInternal", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 4604.0, "function_hash": "264648862111828234493553173313251419686" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" }, { "id": "ASB-A-119041698-c57fce43", "deprecated": true, "digest": { "length": 112.0, "function_hash": "222825782879507962666947708234775844091" }, "match_only_versions": [ "11" ], "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819", "signature_type": "Function", "target": { "function": "NotificationManagerService", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "signature_version": "v1" }, { "id": "ASB-A-119041698-d202a501", "signature_type": "Function", "deprecated": true, "target": { "function": "onNotificationActionClick", "file": "services/core/java/com/android/server/notification/NotificationManagerService.java" }, "digest": { "length": 1373.0, "function_hash": "266588313843957953467193973232415822000" }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/frameworks/base/+/24a1d2c990d7ae59d14a78b769dfc64da5cf3819" } ], "severity": "High", "spl": "2021-05-05", "types": [ "ID" ] }