In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate permissions due to a permissions bypass. This could lead to local escalation of privilege that grants access to nearby MAC addresses, with User execution privileges needed. User interaction is needed for exploitation.
{
"types": [
"EoP"
],
"spl": "2021-01-01",
"vanir_signatures": [
{
"id": "ASB-A-167244818-9cdc8120",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
},
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252.0
},
"signature_type": "Function",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
},
{
"id": "ASB-A-167244818-f6aee0ea",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High"
}{
"types": [
"EoP"
],
"spl": "2021-01-01",
"vanir_signatures": [
{
"id": "ASB-A-167244818-7a69eb42",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
},
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
},
{
"signature_type": "Line",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-f2a0a3fb",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High"
}{
"types": [
"EoP"
],
"spl": "2021-01-01",
"vanir_signatures": [
{
"id": "ASB-A-167244818-9db58b23",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
},
{
"signature_type": "Function",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
},
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252.0
},
"id": "ASB-A-167244818-f1d5fbfa",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High"
}{
"types": [
"EoP"
],
"spl": "2021-01-01",
"vanir_signatures": [
{
"id": "ASB-A-167244818-4adfd78f",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
},
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
},
{
"id": "ASB-A-167244818-b5eb6081",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High"
}{
"types": [
"EoP"
],
"spl": "2021-01-01",
"vanir_signatures": [
{
"signature_type": "Line",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-8777c428",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
},
{
"id": "ASB-A-167244818-d82a610c",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252.0
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High"
}