In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 150.0,
"function_hash": "321733357164553032741408608226387281188"
},
"id": "ASB-A-206987762-0b2a442f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"function": "getAvailabilityStatus",
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250217041909215422489376352889381844384",
"30614813453035800348791517300229173792",
"21559428915232086082342630364423049688",
"312487171729731347703751447130010780116",
"297057082058474901114027675289630414523",
"333376375925661085281441576422414143269"
]
},
"id": "ASB-A-206987762-6c353303",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"
],
"types": [
"DoS"
],
"spl": "2022-05-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250217041909215422489376352889381844384",
"30614813453035800348791517300229173792",
"21559428915232086082342630364423049688",
"312487171729731347703751447130010780116",
"297057082058474901114027675289630414523",
"333376375925661085281441576422414143269"
]
},
"id": "ASB-A-206987762-6a853928",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
},
{
"digest": {
"length": 150.0,
"function_hash": "321733357164553032741408608226387281188"
},
"id": "ASB-A-206987762-abac2893",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"function": "getAvailabilityStatus",
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"
],
"types": [
"DoS"
],
"spl": "2022-05-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 150.0,
"function_hash": "321733357164553032741408608226387281188"
},
"id": "ASB-A-206987762-b55a8f16",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"function": "getAvailabilityStatus",
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250217041909215422489376352889381844384",
"30614813453035800348791517300229173792",
"21559428915232086082342630364423049688",
"312487171729731347703751447130010780116",
"297057082058474901114027675289630414523",
"333376375925661085281441576422414143269"
]
},
"id": "ASB-A-206987762-de8e9d68",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"
],
"types": [
"DoS"
],
"spl": "2022-05-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 150.0,
"function_hash": "321733357164553032741408608226387281188"
},
"id": "ASB-A-206987762-842b33fb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"function": "getAvailabilityStatus",
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250217041909215422489376352889381844384",
"30614813453035800348791517300229173792",
"21559428915232086082342630364423049688",
"312487171729731347703751447130010780116",
"297057082058474901114027675289630414523",
"333376375925661085281441576422414143269"
]
},
"id": "ASB-A-206987762-db5b38c1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327",
"target": {
"file": "src/com/android/settings/network/PrivateDnsPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"
],
"types": [
"DoS"
],
"spl": "2022-05-01",
"severity": "High"
}