In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate permissions due to a permissions bypass. This could lead to local escalation of privilege that grants access to nearby MAC addresses, with User execution privileges needed. User interaction is needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High",
"spl": "2021-01-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252
},
"id": "ASB-A-167244818-9cdc8120",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-f6aee0ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High",
"spl": "2021-01-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252
},
"id": "ASB-A-167244818-7a69eb42",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-f2a0a3fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High",
"spl": "2021-01-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-9db58b23",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252
},
"id": "ASB-A-167244818-f1d5fbfa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High",
"spl": "2021-01-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252
},
"id": "ASB-A-167244818-4adfd78f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-b5eb6081",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a"
],
"severity": "High",
"spl": "2021-01-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"46529484947656830240619870944293011565",
"115095491502154654554552142375869085291",
"222788478004123297660585722521648190590",
"131290711615601143351865950679854116077"
],
"threshold": 0.9
},
"id": "ASB-A-167244818-8777c428",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215306438312018792716161680217895491558",
"length": 252
},
"id": "ASB-A-167244818-d82a610c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/0c17049d39b5a8867f030f6f36433564140e124a",
"target": {
"file": "services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java",
"function": "checkCallerIsSystemOr"
}
}
]
}