In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 654.0,
"function_hash": "146225740222064097662007404564289576779"
},
"id": "ASB-A-179975048-14f838f6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"function": "AppPreference",
"file": "src/com/android/settings/vpn2/AppPreference.java"
}
},
{
"digest": {
"length": 841.0,
"function_hash": "22640489919609325713882732711375333994"
},
"id": "ASB-A-179975048-283c6318",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"function": "onCreateDialog",
"file": "src/com/android/settings/vpn2/AppDialogFragment.java"
}
},
{
"digest": {
"length": 153.0,
"function_hash": "316657508535414830937588975580022303780"
},
"id": "ASB-A-179975048-3d66d37c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"function": "isUiRestricted",
"file": "src/com/android/settings/vpn2/AppDialogFragment.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"179604578433728933944084188878803616491",
"263743711992373708320236093901191021133",
"287168401872317820949163726977133431194",
"173153611441286560131249985183257108818",
"305612703754808051371553259038407704326",
"145021250932861504369977775800655861474",
"130235695407336455772521288742420236139",
"197321295494038043825052379967726541196",
"302125649659669665514286164651550337398",
"230524531461541342565570221741183478871",
"295571902962163619747048479510285221828",
"151062334198934241055795868962791755594"
]
},
"id": "ASB-A-179975048-47459096",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"file": "src/com/android/settings/vpn2/AppPreference.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"203672420802591882195033062432345984370",
"245769591005352220015596537011892043671",
"316219622028360940670670761146118990568",
"45655343949508074561588778196001568865",
"105842248601038760606503281218505655029",
"319288495519586171905692575195650412644",
"5931153598307458158961870516245997700",
"199484865335580362943087483925432877804",
"186978618808013905031115306140254805796",
"84928599281655998255880937823807919609",
"69586483132882604361887274493005422476",
"96794901227541202364131161774691071416",
"215644479940076039302157223118511383794",
"261325344041457971308431415421971501552",
"109932388579657962600053503098445552067",
"68338111561984741143906437224467332970",
"289235851255458248170792750859670189515",
"159367935496363242023982217070173173458",
"197613153472692313592428033679223268706"
]
},
"id": "ASB-A-179975048-7f5cda4b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"file": "src/com/android/settings/vpn2/AppDialogFragment.java"
}
},
{
"digest": {
"length": 120.0,
"function_hash": "335915459027265714425714265626005612958"
},
"id": "ASB-A-179975048-8ab1bd67",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3",
"target": {
"function": "onCreate",
"file": "src/com/android/settings/vpn2/AppDialogFragment.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/735a216da31d8440d23fed4355521013ead630f3"
],
"types": [
"EoP"
],
"spl": "2021-06-01",
"severity": "High"
}