In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293894919682533279417409768143688055272",
"125017386065752119801271350230024963917",
"98240877585594083532658196103488762778",
"49637962719436305270750684907786862617",
"173988390073332405866564626040255519587",
"153848475737633383354480853090555634228",
"205587061258356867390557655381897955665",
"211042037113326649499474587179225206860",
"241486575573978317060241110346048731429",
"304921336299284933037739496659726670335",
"172517702795293911460609626377993925459",
"78787863848648921806085704926544058268",
"300316775662149937775150564162825048590",
"225648968700162184360871430497125855095",
"219940909762499739790260461691179653343",
"82968461836783890943597601697866500974",
"160870143980652861038703041657017432940",
"49426294310508672855491420786231775321",
"155177280073207546586894828603126899936",
"264771913794279986617310087775540966547",
"36924169872832592583255167841817492832",
"90880675455100952650991604390945389770",
"296957341408952226248117042491327201030",
"10349509342964566596136519013606028749"
]
},
"id": "ASB-A-177573895-12f11383",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f24c6a9682fe12a018403daa5d2c3462996e150",
"target": {
"file": "src/com/android/settings/wifi/details/WifiNetworkDetailsFragment.java"
}
},
{
"digest": {
"length": 296.0,
"function_hash": "126161142787430271600164407584444091660"
},
"id": "ASB-A-177573895-9e01c399",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f24c6a9682fe12a018403daa5d2c3462996e150",
"target": {
"function": "onCreateOptionsMenu",
"file": "src/com/android/settings/wifi/details/WifiNetworkDetailsFragment.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/1f24c6a9682fe12a018403daa5d2c3462996e150"
],
"types": [
"EoP"
],
"spl": "2021-07-01",
"severity": "High"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293894919682533279417409768143688055272",
"125017386065752119801271350230024963917",
"98240877585594083532658196103488762778",
"49637962719436305270750684907786862617",
"173988390073332405866564626040255519587",
"153848475737633383354480853090555634228",
"205587061258356867390557655381897955665",
"211042037113326649499474587179225206860",
"241486575573978317060241110346048731429",
"304921336299284933037739496659726670335",
"172517702795293911460609626377993925459",
"78787863848648921806085704926544058268",
"300316775662149937775150564162825048590",
"225648968700162184360871430497125855095",
"219940909762499739790260461691179653343",
"82968461836783890943597601697866500974",
"160870143980652861038703041657017432940",
"49426294310508672855491420786231775321",
"155177280073207546586894828603126899936",
"264771913794279986617310087775540966547",
"36924169872832592583255167841817492832",
"90880675455100952650991604390945389770",
"296957341408952226248117042491327201030",
"10349509342964566596136519013606028749"
]
},
"id": "ASB-A-177573895-a4b89b22",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/649bed1524bcabe8ec10dbfa6ef900437c2eab78",
"target": {
"file": "src/com/android/settings/wifi/details/WifiNetworkDetailsFragment.java"
}
},
{
"digest": {
"length": 296.0,
"function_hash": "126161142787430271600164407584444091660"
},
"id": "ASB-A-177573895-b19a6efc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/649bed1524bcabe8ec10dbfa6ef900437c2eab78",
"target": {
"function": "onCreateOptionsMenu",
"file": "src/com/android/settings/wifi/details/WifiNetworkDetailsFragment.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/649bed1524bcabe8ec10dbfa6ef900437c2eab78"
],
"types": [
"EoP"
],
"spl": "2021-07-01",
"severity": "High"
}