In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution privileges needed. User interaction is needed for exploitation.
{
"severity": "High",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "110471065559829752554935866900015461336",
"length": 251.0
},
"deprecated": false,
"id": "ASB-A-170474245-0ad7f9c4",
"target": {
"function": "onServiceDisconnected",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "56409343096862754226951582261298312970",
"length": 859.0
},
"deprecated": false,
"id": "ASB-A-170474245-20fb551a",
"target": {
"function": "onServiceConnected",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "79716680092986108916863075368994121250",
"length": 194.0
},
"id": "ASB-A-170474245-631cd475",
"target": {
"function": "run",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"digest": {
"function_hash": "306422859136877549754956806850865742695",
"length": 238.0
},
"signature_version": "v1",
"signature_type": "Function",
"id": "ASB-A-170474245-6f48aa9e",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"target": {
"function": "handleMessage",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"digest": {
"function_hash": "20064830965714214422419865119054988811",
"length": 1749.0
},
"signature_version": "v1",
"signature_type": "Function",
"id": "ASB-A-170474245-8eb85e40",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"target": {
"function": "takeScreenshot",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"143891805458794888044039691740055047769",
"115628583121054857167088809365732741104",
"185691605792531290490490045095389369924",
"261140107587477751361494422923208142689",
"280445775857227383418461670070145865445",
"209482247974075876051900950631519054020",
"164194259885429641913494883831021025609",
"340219694258499881816104466913276938333",
"217876664026887310328653614001839989858",
"141042269887642598989604793431130308750",
"207560207417806801595367766951808780763",
"115628583121054857167088809365732741104",
"275375862838594688769403306284741751713",
"233848439539824119280750802570142940882",
"53610614540470348359265512094417791267",
"240148966297772016545861370756393499603",
"15543019223747274192870719560010921983",
"81755201008607734660144484591148503215",
"158625957929300912796775533546498826353",
"289052045857561026182209678414867201796",
"85672948805385739027690705897744684786",
"317299657746041441650624568340216412263"
],
"threshold": 0.9
},
"id": "ASB-A-170474245-f0adbf4a",
"target": {
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e",
"match_only_versions": [
"8.1"
],
"signature_type": "Function",
"digest": {
"function_hash": "204449224904385149027538857767292552876",
"length": 261.0
},
"signature_version": "v1",
"deprecated": false,
"id": "ASB-A-170474245-fe0e00d1",
"target": {
"function": "onReceive",
"file": "services/core/java/com/android/server/policy/PhoneWindowManager.java"
}
}
],
"types": [
"ID"
],
"spl": "2021-04-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/8a2656d4b69efcec5140f3de5a9a721ffb21112e"
]
}
{
"severity": "High",
"vanir_signatures": [
{
"digest": {
"function_hash": "164180947553608314212022086703583829145",
"length": 1955.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"deprecated": false,
"id": "ASB-A-170474245-55157069",
"target": {
"function": "takeScreenshot",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "329691790898224912548971212711036083655",
"length": 250.0
},
"deprecated": false,
"id": "ASB-A-170474245-7ba88cb0",
"target": {
"function": "onServiceDisconnected",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"digest": {
"line_hashes": [
"77600589018979859184342632672044423663",
"138835695438467938448100111054008449075",
"195703934171339726357072401057580491117",
"324437717237707092838220549383987474515",
"261275509057646758026270124242200183576",
"114095665814444899498182893156917143146",
"297334502183032511428029139741810351015",
"337780159263611058614800915541289043337",
"130676898797494817445971517598337703286",
"11315482159266637573461342728440893857",
"143891805458794888044039691740055047769",
"115628583121054857167088809365732741104",
"185691605792531290490490045095389369924",
"261140107587477751361494422923208142689",
"280445775857227383418461670070145865445",
"209482247974075876051900950631519054020",
"164194259885429641913494883831021025609",
"94994249117971007341633914079770864661",
"23142044760023046465937182817830363437",
"18764798353017992895423320783700714726",
"207560207417806801595367766951808780763",
"115628583121054857167088809365732741104",
"132718203293601828225026119500154912991",
"114416905962459712367663447938958173899",
"303046612085731023450634031660977174906",
"154004200589510840670534864340771583973",
"41456303996301209175654644252096731680",
"137996832445665701877774304569994522549"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"deprecated": false,
"id": "ASB-A-170474245-b9880efa",
"target": {
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"match_only_versions": [
"9"
],
"id": "ASB-A-170474245-d00e6b2c",
"signature_type": "Function",
"digest": {
"function_hash": "128268047118787842790280521556671856318",
"length": 47.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"target": {
"function": "ScreenshotHelper",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"digest": {
"function_hash": "60815121350646520059281959364333058946",
"length": 237.0
},
"signature_version": "v1",
"signature_type": "Function",
"id": "ASB-A-170474245-d28bb761",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"target": {
"function": "handleMessage",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "70118981657322782358031299175777716704",
"length": 812.0
},
"deprecated": false,
"id": "ASB-A-170474245-e7021300",
"target": {
"function": "onServiceConnected",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "79716680092986108916863075368994121250",
"length": 194.0
},
"deprecated": false,
"id": "ASB-A-170474245-ef091dc8",
"target": {
"function": "run",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
}
],
"types": [
"ID"
],
"spl": "2021-04-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/19f28d7894d4c518b4343e601d745846aaff6562"
]
}
{
"severity": "High",
"vanir_signatures": [
{
"digest": {
"function_hash": "79716680092986108916863075368994121250",
"length": 194.0
},
"signature_version": "v1",
"signature_type": "Function",
"id": "ASB-A-170474245-54d9b593",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"target": {
"function": "run",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"77600589018979859184342632672044423663",
"138835695438467938448100111054008449075",
"195703934171339726357072401057580491117",
"324437717237707092838220549383987474515",
"261275509057646758026270124242200183576",
"114095665814444899498182893156917143146",
"297334502183032511428029139741810351015",
"337780159263611058614800915541289043337",
"130676898797494817445971517598337703286",
"11315482159266637573461342728440893857",
"307221437914687958241282189084320710987",
"285592678935720424275201562407889572486",
"80386112023886062437792909134782154987",
"189283216277676615971863938045102662750",
"143891805458794888044039691740055047769",
"115628583121054857167088809365732741104",
"185691605792531290490490045095389369924",
"261140107587477751361494422923208142689",
"280445775857227383418461670070145865445",
"209522501700763667324704599910806597393",
"317299657746041441650624568340216412263",
"209482247974075876051900950631519054020",
"164194259885429641913494883831021025609",
"94994249117971007341633914079770864661",
"23142044760023046465937182817830363437",
"18764798353017992895423320783700714726",
"207560207417806801595367766951808780763",
"115628583121054857167088809365732741104",
"132718203293601828225026119500154912991",
"114416905962459712367663447938958173899",
"303046612085731023450634031660977174906",
"154004200589510840670534864340771583973",
"41456303996301209175654644252096731680",
"137996832445665701877774304569994522549"
],
"threshold": 0.9
},
"id": "ASB-A-170474245-57744a77",
"target": {
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "70118981657322782358031299175777716704",
"length": 812.0
},
"id": "ASB-A-170474245-5c415b78",
"target": {
"function": "onServiceConnected",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"digest": {
"function_hash": "164180947553608314212022086703583829145",
"length": 1955.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"deprecated": false,
"id": "ASB-A-170474245-827b8149",
"target": {
"function": "takeScreenshot",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"id": "ASB-A-170474245-9ae6d5a6",
"match_only_versions": [
"10"
],
"signature_type": "Function",
"digest": {
"function_hash": "128268047118787842790280521556671856318",
"length": 47.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"target": {
"function": "ScreenshotHelper",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"digest": {
"function_hash": "60815121350646520059281959364333058946",
"length": 237.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"deprecated": false,
"id": "ASB-A-170474245-9e5cd8ec",
"target": {
"function": "handleMessage",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "329691790898224912548971212711036083655",
"length": 250.0
},
"deprecated": false,
"id": "ASB-A-170474245-c2be0fd6",
"target": {
"function": "onServiceDisconnected",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
}
],
"types": [
"ID"
],
"spl": "2021-04-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/9908e1a14575b5543fef15032f9fe495382fce87"
]
}
{
"severity": "High",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040",
"target": {
"function": "ScreenshotHelper",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "128268047118787842790280521556671856318",
"length": 47.0
},
"signature_version": "v1",
"deprecated": false,
"id": "ASB-A-170474245-551f955b",
"match_only_versions": [
"11"
]
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "22809351054398666066421012939410547017",
"length": 331.0
},
"deprecated": false,
"id": "ASB-A-170474245-819db734",
"target": {
"function": "onServiceDisconnected",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "271377662401570644646863518628417292460",
"length": 2642.0
},
"deprecated": false,
"id": "ASB-A-170474245-9439da49",
"target": {
"function": "takeScreenshot",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "20455326068036206381396105061920251502",
"length": 473.0
},
"id": "ASB-A-170474245-9c79d9d2",
"target": {
"function": "handleMessage",
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
},
{
"digest": {
"line_hashes": [
"116450466506470545318778651666712832087",
"121420531270659993915324703089371619996",
"297549409032047336603336432861588311785",
"319614796086712876248558461322715620703",
"195703934171339726357072401057580491117",
"43892676080766075647821199321798924229",
"232240758963934812122389127377881924419",
"322359540847617984531227783223310894447",
"297334502183032511428029139741810351015",
"337780159263611058614800915541289043337",
"130676898797494817445971517598337703286",
"46490013669708417916189064978739180150",
"72440771798109947479346861181536856196",
"115628583121054857167088809365732741104",
"108974930582014649650341735444539206297",
"125940137684469479304453969871671188144",
"107070562921001971270765437064737194963",
"105321418416374592874556617040125871245",
"246103281044010004163379904280303725695",
"134936717700520996111863590882576319776",
"242784093258228918344076887627442914882",
"27624717268437036290572894859810766554",
"55797864514606465432098823878492337217",
"15119907896171415065163875651749557102",
"207560207417806801595367766951808780763",
"115628583121054857167088809365732741104",
"108974930582014649650341735444539206297",
"135989387444381853970325045058573743821",
"194124705286390864219973302850213471289",
"145581280483197183904059784969146988351",
"154004200589510840670534864340771583973",
"121710230117842684942433989274761969520",
"291079541257669091349578890560241659605"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"id": "ASB-A-170474245-df4db547",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040",
"target": {
"file": "core/java/com/android/internal/util/ScreenshotHelper.java"
}
}
],
"types": [
"ID"
],
"spl": "2021-04-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/a5141a4b9692237110c4361d71dd19d19e31c040"
]
}