In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 1817.0,
"function_hash": "118891934688457000588694617252251358123"
},
"id": "ASB-A-153356561-14bcd385",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c",
"target": {
"function": "updateCfi",
"file": "src/com/android/phone/NotificationMgr.java"
}
},
{
"digest": {
"length": 935.0,
"function_hash": "291758995638928117729529931136582371400"
},
"id": "ASB-A-153356561-19ab7166",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c",
"target": {
"function": "showDataDisconnectedRoaming",
"file": "src/com/android/phone/NotificationMgr.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"265140102369180153285569643997638336446",
"56764018562594915487821848992244143453",
"257363152266438189000120890717951228671",
"340228265644653042191994361831970247695",
"40603954702908614189737089737507001609",
"46172220657390890801239250354430434439",
"122955238063153417043208236720308182883",
"40957653701084111105334611405985659407",
"153180109067042416946594760160744867278",
"9579720642722567617161959736900012085",
"310779639648123452954544692477443865574",
"138097297092970187919989632528491147129",
"327945833271495185885896893359366071469",
"260806432887035010908317663305480350689",
"277319764255446523099854316247119081032",
"225933412891481146513674979089324314435"
]
},
"id": "ASB-A-153356561-97668fb6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c",
"target": {
"file": "src/com/android/phone/NotificationMgr.java"
}
},
{
"digest": {
"length": 3934.0,
"function_hash": "106090137011265485625882723923773067534"
},
"id": "ASB-A-153356561-dd86cc42",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c",
"target": {
"function": "updateMwi",
"file": "src/com/android/phone/NotificationMgr.java"
}
},
{
"digest": {
"length": 1245.0,
"function_hash": "50445700416993342029039016348416028384"
},
"id": "ASB-A-153356561-e85bace1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c",
"target": {
"function": "showNetworkSelection",
"file": "src/com/android/phone/NotificationMgr.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/services/Telephony/+/b722e6d0bef5bdcf3cf7368b765ed08a98bdee1c"
],
"types": [
"ID"
],
"spl": "2020-10-01",
"severity": "High"
}