In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored binder identities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331031388131540579475214603324163724844",
"323037391905666586384279774118954471672",
"215554830602465229355840717896981913703",
"149230313474969070598520701880603036755",
"134010747916522610151929654874294259598",
"151970777628540297793563451857189963764",
"117567877080121797693140800357116016581",
"127374245776578975138591751622307996959",
"336296631800389946765033788516789553359",
"11032023063787285186857778675373469632",
"4501404471160037808372688392779122540",
"171677183759088645878029272492572123695",
"228018945180162986634807178869350755067",
"222464827308863862974330008938978707080",
"107878931015274404143201282179390478754",
"99486981371749262777117631794243679510",
"294056663648146053941484314585294387155",
"232912062069782270177275777794099907974",
"319400611701180374094705222770068096210",
"310072734640302591499567926052705177738",
"204360154700602870456729039133590433083",
"41487688103422027305050012195459520505",
"83824267570958773236860877265162508689",
"43908926629267414451069488606162008971",
"75424631733123940672369797262138112533",
"44722273011818371414630744820407727910",
"311335353701681436225274165545145662373",
"204667720238832498027281741975691880675",
"56590903116781125031328354091970133374",
"117758681325298599905721376602189342440",
"70461102999426155058002731870988830958",
"52354260752047579464042915460027874304",
"146331085514301248948112837685232906296",
"121638129813405871650953897913072057809",
"141225725236196650202056194022698496202",
"67022221854793188141573417438041238710",
"228920388115998562765459605850176649754",
"271297309464530356366798750116385409427",
"328251699819898367807133930453204395345"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-4d0bec97",
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 11092.0,
"function_hash": "197257857363080504148794326638835674861"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-f332751a",
"signature_type": "Function",
"target": {
"function": "getContentProviderImpl",
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3"
],
"spl": "2021-02-01",
"severity": "High",
"types": [
"EoP"
]
}{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3"
],
"spl": "2021-02-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 11092.0,
"function_hash": "197257857363080504148794326638835674861"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-7b309433",
"signature_type": "Function",
"target": {
"function": "getContentProviderImpl",
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331031388131540579475214603324163724844",
"323037391905666586384279774118954471672",
"215554830602465229355840717896981913703",
"149230313474969070598520701880603036755",
"134010747916522610151929654874294259598",
"151970777628540297793563451857189963764",
"117567877080121797693140800357116016581",
"127374245776578975138591751622307996959",
"336296631800389946765033788516789553359",
"11032023063787285186857778675373469632",
"4501404471160037808372688392779122540",
"171677183759088645878029272492572123695",
"228018945180162986634807178869350755067",
"222464827308863862974330008938978707080",
"107878931015274404143201282179390478754",
"99486981371749262777117631794243679510",
"294056663648146053941484314585294387155",
"232912062069782270177275777794099907974",
"319400611701180374094705222770068096210",
"310072734640302591499567926052705177738",
"204360154700602870456729039133590433083",
"41487688103422027305050012195459520505",
"83824267570958773236860877265162508689",
"43908926629267414451069488606162008971",
"75424631733123940672369797262138112533",
"44722273011818371414630744820407727910",
"311335353701681436225274165545145662373",
"204667720238832498027281741975691880675",
"56590903116781125031328354091970133374",
"117758681325298599905721376602189342440",
"70461102999426155058002731870988830958",
"52354260752047579464042915460027874304",
"146331085514301248948112837685232906296",
"121638129813405871650953897913072057809",
"141225725236196650202056194022698496202",
"67022221854793188141573417438041238710",
"228920388115998562765459605850176649754",
"271297309464530356366798750116385409427",
"328251699819898367807133930453204395345"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-dcf4665f",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
},
"signature_type": "Line"
}
]
}{
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 11092.0,
"function_hash": "197257857363080504148794326638835674861"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-7389894c",
"signature_type": "Function",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java",
"function": "getContentProviderImpl"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331031388131540579475214603324163724844",
"323037391905666586384279774118954471672",
"215554830602465229355840717896981913703",
"149230313474969070598520701880603036755",
"134010747916522610151929654874294259598",
"151970777628540297793563451857189963764",
"117567877080121797693140800357116016581",
"127374245776578975138591751622307996959",
"336296631800389946765033788516789553359",
"11032023063787285186857778675373469632",
"4501404471160037808372688392779122540",
"171677183759088645878029272492572123695",
"228018945180162986634807178869350755067",
"222464827308863862974330008938978707080",
"107878931015274404143201282179390478754",
"99486981371749262777117631794243679510",
"294056663648146053941484314585294387155",
"232912062069782270177275777794099907974",
"319400611701180374094705222770068096210",
"310072734640302591499567926052705177738",
"204360154700602870456729039133590433083",
"41487688103422027305050012195459520505",
"83824267570958773236860877265162508689",
"43908926629267414451069488606162008971",
"75424631733123940672369797262138112533",
"44722273011818371414630744820407727910",
"311335353701681436225274165545145662373",
"204667720238832498027281741975691880675",
"56590903116781125031328354091970133374",
"117758681325298599905721376602189342440",
"70461102999426155058002731870988830958",
"52354260752047579464042915460027874304",
"146331085514301248948112837685232906296",
"121638129813405871650953897913072057809",
"141225725236196650202056194022698496202",
"67022221854793188141573417438041238710",
"228920388115998562765459605850176649754",
"271297309464530356366798750116385409427",
"328251699819898367807133930453204395345"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-b259835b",
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3"
],
"spl": "2021-02-01",
"severity": "High",
"types": [
"EoP"
]
}{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3"
],
"spl": "2021-02-01",
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331031388131540579475214603324163724844",
"323037391905666586384279774118954471672",
"215554830602465229355840717896981913703",
"149230313474969070598520701880603036755",
"134010747916522610151929654874294259598",
"151970777628540297793563451857189963764",
"117567877080121797693140800357116016581",
"127374245776578975138591751622307996959",
"336296631800389946765033788516789553359",
"11032023063787285186857778675373469632",
"4501404471160037808372688392779122540",
"171677183759088645878029272492572123695",
"228018945180162986634807178869350755067",
"222464827308863862974330008938978707080",
"107878931015274404143201282179390478754",
"99486981371749262777117631794243679510",
"294056663648146053941484314585294387155",
"232912062069782270177275777794099907974",
"319400611701180374094705222770068096210",
"310072734640302591499567926052705177738",
"204360154700602870456729039133590433083",
"41487688103422027305050012195459520505",
"83824267570958773236860877265162508689",
"43908926629267414451069488606162008971",
"75424631733123940672369797262138112533",
"44722273011818371414630744820407727910",
"311335353701681436225274165545145662373",
"204667720238832498027281741975691880675",
"56590903116781125031328354091970133374",
"117758681325298599905721376602189342440",
"70461102999426155058002731870988830958",
"52354260752047579464042915460027874304",
"146331085514301248948112837685232906296",
"121638129813405871650953897913072057809",
"141225725236196650202056194022698496202",
"67022221854793188141573417438041238710",
"228920388115998562765459605850176649754",
"271297309464530356366798750116385409427",
"328251699819898367807133930453204395345"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-516e3cd0",
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 11092.0,
"function_hash": "197257857363080504148794326638835674861"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-a9d9bc4d",
"signature_type": "Function",
"target": {
"function": "getContentProviderImpl",
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
}
],
"severity": "High"
}{
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 11092.0,
"function_hash": "197257857363080504148794326638835674861"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-f5f513af",
"signature_type": "Function",
"target": {
"function": "getContentProviderImpl",
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331031388131540579475214603324163724844",
"323037391905666586384279774118954471672",
"215554830602465229355840717896981913703",
"149230313474969070598520701880603036755",
"134010747916522610151929654874294259598",
"151970777628540297793563451857189963764",
"117567877080121797693140800357116016581",
"127374245776578975138591751622307996959",
"336296631800389946765033788516789553359",
"11032023063787285186857778675373469632",
"4501404471160037808372688392779122540",
"171677183759088645878029272492572123695",
"228018945180162986634807178869350755067",
"222464827308863862974330008938978707080",
"107878931015274404143201282179390478754",
"99486981371749262777117631794243679510",
"294056663648146053941484314585294387155",
"232912062069782270177275777794099907974",
"319400611701180374094705222770068096210",
"310072734640302591499567926052705177738",
"204360154700602870456729039133590433083",
"41487688103422027305050012195459520505",
"83824267570958773236860877265162508689",
"43908926629267414451069488606162008971",
"75424631733123940672369797262138112533",
"44722273011818371414630744820407727910",
"311335353701681436225274165545145662373",
"204667720238832498027281741975691880675",
"56590903116781125031328354091970133374",
"117758681325298599905721376602189342440",
"70461102999426155058002731870988830958",
"52354260752047579464042915460027874304",
"146331085514301248948112837685232906296",
"121638129813405871650953897913072057809",
"141225725236196650202056194022698496202",
"67022221854793188141573417438041238710",
"228920388115998562765459605850176649754",
"271297309464530356366798750116385409427",
"328251699819898367807133930453204395345"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3",
"id": "ASB-A-172935267-ffd386ad",
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/am/ActivityManagerService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/69eaa90b0e4cc78fa2f518a50182bc9e4c9e87f3"
],
"spl": "2021-02-01",
"severity": "High",
"types": [
"EoP"
]
}