In setPowerModeWithHandle of comandroidserverpowerPowerManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/20b47da57ac2067429519c83f3053269195a38c8"
],
"types": [
"EoP"
],
"severity": "High",
"vanir_signatures": [
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/20b47da57ac2067429519c83f3053269195a38c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96991885765115505475066252335694599916",
"273922987633740860841505973695188527767",
"270091768945198598193258492359184190108",
"64205244571183048567679183391949558531",
"212893886433266374958240553564488320109",
"20938530277577266907359184084044216867",
"110006106884010207983081217542663599541",
"125086066664810405775232003594993594214",
"229216421008578521348879821148732494666",
"195478624320315993648943912302646496010",
"46704122301940164194278319291421983977",
"208997585642586150717060693395011784020",
"57584374418139434918737515078687283483",
"297645485397830571402904992574058236662",
"111533090527312627149407305151690132604",
"300100997696033668252368351853991920809",
"281278560213192793065827282603829063497",
"130124360848044646004962442902557624427",
"213959317843305007925795518982060420425",
"133913021268363244034123103870974558401",
"282141342398053936689739310441005562170",
"57846412058526012077099202344636348965",
"278413228405870178899917096683907491562",
"74484561210222128247657159809481301320",
"71249626891052790175679826150612773199",
"158648707315037667844268992612908230351",
"243597661729778640561861798013032154214",
"263835920365801970449077070795675480026"
]
},
"id": "ASB-A-174243830-2c8f614a",
"deprecated": false,
"target": {
"file": "services/core/jni/com_android_server_power_PowerManagerService.cpp"
}
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/20b47da57ac2067429519c83f3053269195a38c8",
"digest": {
"function_hash": "74139256840613774441234374873579228793",
"length": 975.0
},
"id": "ASB-A-174243830-5db1cab7",
"deprecated": false,
"target": {
"file": "services/core/jni/com_android_server_power_PowerManagerService.cpp",
"function": "setPowerBoostWithHandle"
}
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/20b47da57ac2067429519c83f3053269195a38c8",
"digest": {
"function_hash": "84135374911577923711946618575558859906",
"length": 988.0
},
"id": "ASB-A-174243830-7c48108d",
"deprecated": false,
"target": {
"file": "services/core/jni/com_android_server_power_PowerManagerService.cpp",
"function": "setPowerModeWithHandle"
}
}
],
"spl": "2021-04-01"
}