In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper state validation. This could lead to local escalation of privilege via hidden services with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"spl": "2021-06-05",
"vanir_signatures": [
{
"id": "ASB-A-156090809-4739f9cb",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannel"
},
"deprecated": false,
"digest": {
"function_hash": "111584078502230816403717076516820119789",
"length": 598.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "init"
},
"deprecated": false,
"digest": {
"function_hash": "250547676923079044258146479133817299648",
"length": 3881.0
},
"id": "ASB-A-156090809-63820331",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-78f26c7b",
"target": {
"file": "services/core/java/com/android/server/am/ActiveServices.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"243832457941029853949081076540369947021",
"277284926499945436316168361803506615905",
"86741531392393004604985203474163363118",
"85767373482419062646688911510956942125",
"300803734125860664058301811104765396099",
"169760345060486125830023376526458358710",
"105708468389041967717197549242380213410"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-95b97a6d",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "onStart"
},
"deprecated": false,
"digest": {
"function_hash": "43216563467910227820847804692491627652",
"length": 2989.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"187355791372883160417723495679967006022",
"75487492559796743692513204222700372064",
"141187381117624306969262177550766424061",
"332081439037483108083136921297061159408",
"14355666046773908531394252989382986305",
"88100818466516046201793863538742143208",
"246266354051427817525126374005165313541",
"72520963646466710574185766743126728888",
"64047617596711551078617618504035000632",
"222189706418655908001261389439699611251",
"206196063890908017515809172185009776621",
"10190352094524491590685236081924458053",
"86522650224566773563492643462170964444",
"135330999277280683433492570068424212805",
"174228653939042307533106315504964859833",
"316624534489010208008926214702224983098",
"16829297465711641601830374145007083241",
"112187538004766868234516579624254172259",
"241337226289593307610702390552952101558",
"8128605141004726995257403743213754806",
"14895404681102803297110275699274823328",
"242418517489375424389371523239242638423",
"245064379344793993550905167757370643370",
"289949581154331311991103052026330539458",
"155675230082813956299354885880940807271",
"283461208129323771366816689172809163461",
"142540240317097645247846181006249588175",
"275115920561201798845048616415603407741",
"1538195401466889385134086347164765831",
"32972217884364282086416573532478697030",
"169748895487926335790575019324997988142",
"84075533363893082316479102397472964264",
"176366759785528563692339084705175210581",
"63173928883494864831535679805478538891",
"290926879052844139575534580356396441258",
"153833355527544691740712686718885549607",
"39987880040799005197388233599488075994",
"290759395672791595184489056074025304266",
"311158433717661000923414722681548865809"
],
"threshold": 0.9
},
"id": "ASB-A-156090809-9a64adf0",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-b947efd0",
"target": {
"file": "core/java/android/app/ActivityManagerInternal.java"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"238043717304826682281836435467161091815",
"323123403965306371450116988446522796959"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannelGroup"
},
"deprecated": false,
"digest": {
"function_hash": "145668514877916665703330540893108466399",
"length": 762.0
},
"id": "ASB-A-156090809-fa5ac4b1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/b320763eb82eb81e42df5b649658b78742ad0b5e"
],
"severity": "High"
}
{
"types": [
"EoP"
],
"spl": "2021-06-05",
"vanir_signatures": [
{
"id": "ASB-A-156090809-1c223124",
"target": {
"file": "services/core/java/com/android/server/am/ActiveServices.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"143038243953477509762820134210081367915",
"277284926499945436316168361803506615905",
"171777540259197153321087965009241335650",
"81503812164268784719774457520424025451",
"300803734125860664058301811104765396099",
"169760345060486125830023376526458358710",
"105708468389041967717197549242380213410"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-38a523ad",
"target": {
"file": "core/java/android/app/ActivityManagerInternal.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"292838447614910220335108979850456341523",
"185231612750886896102179564220812068091",
"15809105330828169395900871850693460405",
"318360907860864895871432056468246873292",
"297610270804447326315460234237802441812",
"92605505553658970884947528112830853607",
"159098421369720397124789680878006324432"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-5f466cdd",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "init"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "300897245980455220391517969548846753095",
"length": 4312.0
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-757ebd79",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannel"
},
"digest": {
"function_hash": "111584078502230816403717076516820119789",
"length": 598.0
},
"signature_type": "Function",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-a1e0d0a5",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"digest": {
"line_hashes": [
"187355791372883160417723495679967006022",
"75487492559796743692513204222700372064",
"141187381117624306969262177550766424061",
"332081439037483108083136921297061159408",
"1642739605963663691286648815684797142",
"230434723012429417907068704924191329661",
"313097471319081906022034394478121468455",
"285114449567110604927652085673409442214",
"127629530176147319990418955576947333093",
"340110981213164736206224123811593602776",
"90252292268604074669136635299551653600",
"201062232803521611329721056007255819929",
"1612447527434073972353718988625693693",
"310130221396432750129690167950881996791",
"242194405522622604629680505355969725672",
"20878326009297541572003400526334620434",
"16829297465711641601830374145007083241",
"112187538004766868234516579624254172259",
"241337226289593307610702390552952101558",
"8128605141004726995257403743213754806",
"14895404681102803297110275699274823328",
"242418517489375424389371523239242638423",
"245064379344793993550905167757370643370",
"289949581154331311991103052026330539458",
"155675230082813956299354885880940807271",
"283461208129323771366816689172809163461",
"142540240317097645247846181006249588175",
"275115920561201798845048616415603407741",
"1538195401466889385134086347164765831",
"32972217884364282086416573532478697030",
"169748895487926335790575019324997988142",
"84075533363893082316479102397472964264",
"176366759785528563692339084705175210581",
"63173928883494864831535679805478538891",
"290926879052844139575534580356396441258",
"153833355527544691740712686718885549607",
"39987880040799005197388233599488075994",
"290759395672791595184489056074025304266",
"311158433717661000923414722681548865809"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-a7bb5d98",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannelGroup"
},
"digest": {
"function_hash": "145668514877916665703330540893108466399",
"length": 762.0
},
"signature_type": "Function",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-b025cb7d",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"271541905220126286055512184606452466921",
"160940047251359456663134390730196618579",
"17784837286458865125772362870221140509",
"222544974210345868512662772644031468919"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-b188ac5d",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "onStart"
},
"deprecated": false,
"digest": {
"function_hash": "278714983940801963460151141254747649470",
"length": 3301.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/cfd88a8e244c2f89a1a6502e9683deb17692491d"
],
"severity": "High"
}
{
"types": [
"EoP"
],
"spl": "2021-06-05",
"vanir_signatures": [
{
"id": "ASB-A-156090809-00142fba",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannelGroup"
},
"deprecated": false,
"digest": {
"function_hash": "169918711778260117441507044793440816207",
"length": 770.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-06e3e6ce",
"target": {
"file": "services/core/java/com/android/server/am/ActiveServices.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"116665443418320740901790274515282845286",
"127723794484949765253308390424340886076",
"171777540259197153321087965009241335650",
"259925746459705205065066538539981248564",
"300803734125860664058301811104765396099",
"169760345060486125830023376526458358710",
"105708468389041967717197549242380213410"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-084d5feb",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannel"
},
"digest": {
"function_hash": "178522623096125930615244555104531679566",
"length": 606.0
},
"signature_type": "Function",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-0e537939",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"187355791372883160417723495679967006022",
"75487492559796743692513204222700372064",
"141187381117624306969262177550766424061",
"332081439037483108083136921297061159408",
"264127085301898716414822861457514003014",
"244657437157369239927942296586159665790",
"306644102527170966894838446634778986646",
"72315196149643362365193780831452840518",
"127629530176147319990418955576947333093",
"340110981213164736206224123811593602776",
"90252292268604074669136635299551653600",
"201062232803521611329721056007255819929",
"269984681607717942230041238183478767994",
"167127522894374550516781387978872254959",
"130230728442927598489872723376599645689",
"44931634356120266472058698434878519404",
"333204681617483418239739955567033761023",
"57915191328573266227074644900538772118",
"241337226289593307610702390552952101558",
"8128605141004726995257403743213754806",
"14895404681102803297110275699274823328",
"242418517489375424389371523239242638423",
"245064379344793993550905167757370643370",
"289949581154331311991103052026330539458",
"155675230082813956299354885880940807271",
"28284933431173073618886616435375744176",
"44577405713206677521916055436946121489",
"137007948858326812179010649371956364118",
"45791029998817299130183393007229542476",
"81085408704060509994687980035553871387",
"171410578728720418430938054882666692254",
"26162651171894968468758333285774930320",
"337501065400858714145630933845349533302",
"195124392185818451383373396196255440243",
"290926879052844139575534580356396441258",
"153833355527544691740712686718885549607",
"39987880040799005197388233599488075994",
"290759395672791595184489056074025304266",
"311158433717661000923414722681548865809"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-5b175fdd",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "onStart"
},
"deprecated": false,
"digest": {
"function_hash": "119627800141772573490099665767789249980",
"length": 3589.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "init"
},
"deprecated": false,
"digest": {
"function_hash": "6946159469314443240635356953224681680",
"length": 4999.0
},
"id": "ASB-A-156090809-6649c876",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-b5126a3e",
"target": {
"file": "core/java/android/app/ActivityManagerInternal.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"270478205548560295237232598755633369132",
"18963717738491816940910137303207083259",
"184233344702323924628559886519027109379"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-cf370069",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"314799369627835642921827884396392181379",
"275585177146609854867424008368721034064",
"83267130952656972721763451124818895201",
"91861010904820752819965530418526722706"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/88380a00d5e006f74596b9e899313d5e349efbd5"
],
"severity": "High"
}
{
"types": [
"EoP"
],
"spl": "2021-06-05",
"vanir_signatures": [
{
"id": "ASB-A-156090809-1e7b5694",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteConversationNotificationChannels"
},
"deprecated": false,
"digest": {
"function_hash": "303921968057360378732434480119348644460",
"length": 649.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-653131f8",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "init"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "39357192228470675964027408921176101009",
"length": 6602.0
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-6d060795",
"target": {
"file": "services/core/java/com/android/server/am/ActiveServices.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"326283200280238239064592855991665922290",
"210277226223904655681099756738131513224",
"40714481488390493518633447657709312091",
"259925746459705205065066538539981248564",
"300803734125860664058301811104765396099",
"169760345060486125830023376526458358710",
"105708468389041967717197549242380213410"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-9de2f9b4",
"target": {
"file": "core/java/android/app/ActivityManagerInternal.java"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"260886679655016256207594065347348950127",
"18963717738491816940910137303207083259",
"69554920024208367476691099655833137916"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-a3fec579",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"314799369627835642921827884396392181379",
"275585177146609854867424008368721034064",
"83267130952656972721763451124818895201",
"91861010904820752819965530418526722706"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-b7ca6efe",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannelGroup"
},
"digest": {
"function_hash": "169918711778260117441507044793440816207",
"length": 770.0
},
"signature_type": "Function",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-c15f38c6",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "onStart"
},
"deprecated": false,
"digest": {
"function_hash": "312355051890583095902988902681831660734",
"length": 3903.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-e9609f21",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "deleteNotificationChannel"
},
"deprecated": false,
"digest": {
"function_hash": "178522623096125930615244555104531679566",
"length": 606.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
},
{
"id": "ASB-A-156090809-ea3c33e3",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"136066586050474523948942130984724567994",
"317328557161988027299067624193535264799",
"243174982465969429784986545731999162741",
"332081439037483108083136921297061159408",
"314399857551143726000800372856709065477",
"107728308816260082844208695456956847122",
"83150444550032763363313223262886429493",
"86138962881836013183355708620528867971",
"127629530176147319990418955576947333093",
"340110981213164736206224123811593602776",
"90252292268604074669136635299551653600",
"201062232803521611329721056007255819929",
"116212606344185541932580423880054536174",
"83582195844955888346999258018831877125",
"126679749195986057750343638787376025354",
"139519759878131501572021711144495062132",
"8549711480134553362762460260540307540",
"188953528763314580560876544712586171101",
"241337226289593307610702390552952101558",
"8128605141004726995257403743213754806",
"14895404681102803297110275699274823328",
"242418517489375424389371523239242638423",
"245064379344793993550905167757370643370",
"289949581154331311991103052026330539458",
"155675230082813956299354885880940807271",
"28284933431173073618886616435375744176",
"44577405713206677521916055436946121489",
"137007948858326812179010649371956364118",
"56998041702189628827197416892513632267",
"63018130577528781623220240911644892464",
"320614719389274243496967110305833557217",
"279700239947569734789553478493978475431",
"183278994743218836048111596110345209128",
"292441360687140417644143678735815244023",
"325900048453983065599446974981940778764",
"89929500752778588245473755504340952860",
"179071888680586158488493992053457391698",
"338696697512288443541731626182866187290",
"137226136892127268408655168046244674408",
"252766816954714213781528940804301754942",
"118213190765250607049687892337296311788",
"41084520375023404192471775517219173088",
"54147260690832397825375022626638420423",
"142419154059545195842591614307220191930",
"45791029998817299130183393007229542476",
"81085408704060509994687980035553871387",
"171410578728720418430938054882666692254",
"26162651171894968468758333285774930320",
"337501065400858714145630933845349533302",
"195124392185818451383373396196255440243",
"290926879052844139575534580356396441258",
"153833355527544691740712686718885549607",
"39987880040799005197388233599488075994",
"290759395672791595184489056074025304266",
"311158433717661000923414722681548865809"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/8cb7e0a881fed2a7d80b69aed77275bd483043ad"
],
"severity": "High"
}