In ActivityThread.java, there is a possible way to collide the content provider's authorities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/119dd01b497b5e6e25009785ec36c9877675deef"
],
"severity": "High",
"spl": "2021-11-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197647956-17ab4b8d",
"digest": {
"length": 307.0,
"function_hash": "83847537066315130705128683439746595473"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/119dd01b497b5e6e25009785ec36c9877675deef",
"signature_type": "Function",
"target": {
"file": "core/java/android/app/ActivityThread.java",
"function": "getGetProviderKey"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197647956-67d4e2b4",
"digest": {
"length": 63.0,
"function_hash": "186090913209968310007270946588775242246"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/119dd01b497b5e6e25009785ec36c9877675deef",
"signature_type": "Function",
"target": {
"file": "core/java/android/app/ActivityThread.java",
"function": "hashCode"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197647956-7f98324f",
"digest": {
"line_hashes": [
"326063071765774007490194811495447162636",
"170825892903443840349752480577991783464",
"77664494314481207663226262446989479771",
"190626703168351032357459547838388014024",
"105168086414263267331584705590022045589",
"106477676096924239680826671116988327552",
"263375128250138690553813816092657597134",
"251293968251678546224596977052481725288",
"58633983470847749031155162440115166852",
"153102194172029500120714434103452184387",
"80837712777637115708612122191489820536",
"52179506236020679730444445827758296368",
"133019040517720972468236124462291316197",
"235305076149805394890300297471776512913",
"277860005824901284728682115461520488045",
"1041427847259449195053291678863099657",
"87050125005921400953905059549959077065",
"208505618028930964309869806991951089316",
"71919838620155194110813990162614648515"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/119dd01b497b5e6e25009785ec36c9877675deef",
"signature_type": "Line",
"target": {
"file": "core/java/android/app/ActivityThread.java"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-197647956-8b14bad9",
"digest": {
"length": 126.0,
"function_hash": "307260096682538227382649376847618233623"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/119dd01b497b5e6e25009785ec36c9877675deef",
"signature_type": "Function",
"target": {
"file": "core/java/android/app/ActivityThread.java",
"function": "hashCode"
}
}
],
"types": [
"EoP"
]
}