In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 297.0,
"function_hash": "306408796174320226647143357411811607888"
},
"id": "ASB-A-206807679-0564ff75",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558",
"target": {
"function": "setDiscoverableTimeout",
"file": "android/app/src/com/android/bluetooth/btservice/AdapterService.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"184196211465596637036676436981022160986",
"310663038790803474228144224051457634065",
"235200042516890789000893520623616856433",
"74056111292228662419642069507111208323",
"280865106268737356318352464790165724163",
"31751067178526632610812621753358219135",
"121380037984780544106085503251813162023",
"115406219874387320131559651200307225012",
"202006277810136237772203677493381325889",
"184997035097119368774453889288419654155",
"228403452926252819945841653792026404095",
"79357729360616193902807655643700292302",
"53073610528342643939637634752102331140",
"233298843227634921828128355666204684003",
"129041647635244075524337653918275144826",
"201497200635376658514585156517811832238",
"299108017017304219847357040897943149945",
"26336067661531312286298575742099149644",
"216431135408102165191893687207576056864",
"176281420003676838415340115292266963530",
"219325013445161890951510386503674400884",
"231031870505611136751596413830225061327",
"73397768373368757536479802789304542650",
"86297380719523360092289164958136849650",
"96504084766857505299204479415726309676",
"160057590753693384341480522250881637743",
"1133394177015753540700299389162097589",
"252693157415961571234960786732231294635",
"325256900392167122739568556677971918605",
"59383564349327758604786432256412400049",
"97788076907198308619448996106236548653",
"259482035435254778313450921017276894325"
]
},
"id": "ASB-A-206807679-0f43b4af",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558",
"target": {
"file": "android/app/src/com/android/bluetooth/btservice/AdapterService.java"
}
},
{
"digest": {
"length": 273.0,
"function_hash": "337355188220726876884449145526534949697"
},
"id": "ASB-A-206807679-57193b34",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558",
"target": {
"function": "getDiscoverableTimeout",
"file": "android/app/src/com/android/bluetooth/btservice/AdapterService.java"
}
},
{
"digest": {
"length": 350.0,
"function_hash": "224398954382340583561811694483425651957"
},
"id": "ASB-A-206807679-da1724b4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558",
"target": {
"function": "setScanMode",
"file": "android/app/src/com/android/bluetooth/btservice/AdapterService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"15034289598171731019070901338967543949",
"22452854176303668999173774811771995014",
"218805922682627626445775730674273039717",
"331177562355415707219285459176677723481"
]
},
"id": "ASB-A-206807679-709ca6b9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527",
"target": {
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"91983733559064162424237768282443276951",
"319504346079806563258387665295186025399",
"253609973198217123155236395255894876158",
"199140676438839850654882467789767349138"
]
},
"id": "ASB-A-206807679-e2b45f5d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d",
"target": {
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"325256900392167122739568556677971918605",
"59383564349327758604786432256412400049",
"97788076907198308619448996106236548653"
]
},
"id": "ASB-A-206807679-430bd72c",
"deprecated": false,
"target": {
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
},
"signature_type": "Line",
"match_only_versions": [
"12"
],
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf",
"signature_version": "v1"
},
{
"digest": {
"length": 297.0,
"function_hash": "306408796174320226647143357411811607888"
},
"id": "ASB-A-206807679-e5dba575",
"deprecated": false,
"target": {
"function": "setDiscoverableTimeout",
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
},
"signature_type": "Function",
"match_only_versions": [
"12"
],
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 297.0,
"function_hash": "306408796174320226647143357411811607888"
},
"id": "ASB-A-206807679-3d1f2430",
"deprecated": false,
"target": {
"function": "setDiscoverableTimeout",
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
},
"signature_type": "Function",
"match_only_versions": [
"12L"
],
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"325256900392167122739568556677971918605",
"59383564349327758604786432256412400049",
"97788076907198308619448996106236548653"
]
},
"id": "ASB-A-206807679-a51fd69c",
"deprecated": false,
"target": {
"file": "src/com/android/bluetooth/btservice/AdapterService.java"
},
"signature_type": "Line",
"match_only_versions": [
"12L"
],
"source": "https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}