In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 672.0,
"function_hash": "81810139171775118323283179160047827034"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/d7097b817bb5a661e4bbc22829f6dc0a6ddca27c",
"id": "ASB-A-193444889-2f5dc331",
"target": {
"function": "startListening",
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
},
"signature_type": "Function"
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/55cd8952c051cf8aaac144c914e8f5997ae80363",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"6682212024756171277007439054469407303",
"209711882029363377761582002638931067562",
"158320630735103290764627557418347516601",
"22445546701691648265156247826780286614",
"262505575621538340185066354316660139155",
"92667460322615852668817984762344654739",
"328977152029404174956875132302775369961"
]
},
"signature_version": "v1",
"id": "ASB-A-193444889-cc184cb3",
"target": {
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 516.0,
"function_hash": "129524561234329392028963588651713576109"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/55cd8952c051cf8aaac144c914e8f5997ae80363",
"id": "ASB-A-193444889-efeb2a4e",
"signature_type": "Function",
"target": {
"function": "startListening",
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146850081227967692376201208466657996530",
"327750832339910177008813005609846834661",
"20104264724062620373090630752548946891",
"162502540726198638012524780869162641186"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/d7097b817bb5a661e4bbc22829f6dc0a6ddca27c",
"id": "ASB-A-193444889-f9d60ddb",
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/55cd8952c051cf8aaac144c914e8f5997ae80363",
"https://android.googlesource.com/platform/frameworks/base/+/d7097b817bb5a661e4bbc22829f6dc0a6ddca27c"
],
"spl": "2022-02-01",
"severity": "High",
"types": [
"DoS"
]
}
{
"vanir_signatures": [
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 672.0,
"function_hash": "81810139171775118323283179160047827034"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/1b13bc873c7682847cdfa904f754ebc327eb180b",
"id": "ASB-A-193444889-2ccaabda",
"signature_type": "Function",
"target": {
"function": "startListening",
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/90824714b5f065bbe5671f9808b986194290ae8e",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"6682212024756171277007439054469407303",
"209711882029363377761582002638931067562",
"158320630735103290764627557418347516601",
"22445546701691648265156247826780286614",
"262505575621538340185066354316660139155",
"92667460322615852668817984762344654739",
"328977152029404174956875132302775369961"
]
},
"signature_version": "v1",
"id": "ASB-A-193444889-4b77a797",
"target": {
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 516.0,
"function_hash": "129524561234329392028963588651713576109"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/90824714b5f065bbe5671f9808b986194290ae8e",
"id": "ASB-A-193444889-8c1e9cea",
"target": {
"function": "startListening",
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"146850081227967692376201208466657996530",
"327750832339910177008813005609846834661",
"20104264724062620373090630752548946891",
"162502540726198638012524780869162641186"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/1b13bc873c7682847cdfa904f754ebc327eb180b",
"id": "ASB-A-193444889-e6197bc4",
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/shared/src/com/android/systemui/shared/plugins/PluginManagerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/90824714b5f065bbe5671f9808b986194290ae8e",
"https://android.googlesource.com/platform/frameworks/base/+/1b13bc873c7682847cdfa904f754ebc327eb180b"
],
"spl": "2022-02-01",
"severity": "High",
"types": [
"DoS"
]
}