In ACTIONMANAGEDPROFILEPROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGEDPROFILE_PROVISIONED intent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"165196328349436582360030923817994187530",
"142323484016314999817245832024741395750",
"45882653241144612024616399050563532720",
"151980662705061229486609346240039935145",
"190768989054067055310579774474829269827",
"201832238199760288917697888941600799034"
]
},
"id": "ASB-A-210469972-aaf36ee9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/c5037ec63cdc72846082a66e72b34cf5067a6046",
"target": {
"file": "core/java/android/app/admin/DevicePolicyManager.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"1178195614567482945739198061955508915",
"31806522884155386625637369499141236753",
"285954395801152725255873430966962490431",
"227897398799914715393077234313247382682",
"165104480169788341239788276980274365975",
"177292188181655036985363615814302517162",
"244342151540401799358430309197160692676",
"181203390073414563703186549984229578303",
"295747577431459138783214723720080232905",
"88171394716906819191900992967790721244",
"171330181921549713615954239077365153555",
"18548988099176996864057278395653106571"
]
},
"id": "ASB-A-210469972-accadbc8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/c5037ec63cdc72846082a66e72b34cf5067a6046",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"203289808691371278058937258328814614100",
"121434881783647386077644657305102048621",
"86876281138923748596174675199745902677",
"282109936267780210420752900017556587400"
]
},
"id": "ASB-A-210469972-ade0edfd",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/c5037ec63cdc72846082a66e72b34cf5067a6046",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/BaseIDevicePolicyManager.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/c5037ec63cdc72846082a66e72b34cf5067a6046"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 253.0,
"function_hash": "250093873334471829850819371941542205638"
},
"id": "ASB-A-210469972-2e0d610c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/643d474ae7a92fdd81649993e8d54652db4d99f7",
"target": {
"function": "finishAccountMigration",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"126770901287113181092994384759021439471",
"226949713720262975961857640617629134375",
"12750777737141886692112672794337740245",
"86786463719480147744044891942931028954",
"296931474696659612531751697753888668171",
"57888958134714656376978583733553612137",
"105048981573371348992613639911483961212",
"45645736765208385356595142875357394763",
"154411006352317980768647745974569241111",
"158476285602889413066203666655793104733",
"271805084136454864222455791023592820723",
"188300002174531764168902090990566839171",
"82210351836690846443513195538615440903",
"91888786414128127650247881244066864016",
"64020364376254899850364389227633984882",
"68728240398024612962387659027617384079",
"279724400294053524067234604311829065751",
"150619217421208424828847354377840103947",
"279861004617409870801295119533372596512",
"307603694352794879111688577822745804218",
"6907606922138334484371299075565236871",
"304910121156801056019843047824674174489",
"53584654036499175838198704377668676859",
"140429496537081717390233239429312066527",
"42801350699708305997946404542389117198",
"338276855435276441639946988279696297693",
"257596055235690513255623590287923532857",
"34792215023414834700817897323367957571",
"170153138462704580384084360720422733138",
"311741425933348699866359731845700924976",
"252687884198281453502597102940985632430",
"97037669992202532229136247253287127390",
"299431057903114398517986558811871730173",
"211966202988192482010646975831976079221",
"1261119691966196946321401272554284073",
"27486905656518721481345653258135179211",
"89390164303826736914226791737670002728",
"307603694352794879111688577822745804218",
"169153240682437419861430951779245499511"
]
},
"id": "ASB-A-210469972-54000d2a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/643d474ae7a92fdd81649993e8d54652db4d99f7",
"target": {
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 139.0,
"function_hash": "52020135773200354949955668133061458870"
},
"id": "ASB-A-210469972-96779e8b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/643d474ae7a92fdd81649993e8d54652db4d99f7",
"target": {
"function": "handleFinalization",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 502.0,
"function_hash": "186000692122720881770078323657871377901"
},
"id": "ASB-A-210469972-a0690004",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/643d474ae7a92fdd81649993e8d54652db4d99f7",
"target": {
"function": "finalizeProvisioningInPrimaryProfile",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/643d474ae7a92fdd81649993e8d54652db4d99f7"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"105824338701402452381177047086707705489",
"94810083659911177981434380572743116134",
"293752882539457751734743719610255167666",
"65669243572844457802638869826327546513",
"223973514222838089371219471462234527473",
"22332860073895290205979785039757149095",
"8637858284468504886779232296271611056",
"24443583605833590446008898529147896667",
"295747577431459138783214723720080232905",
"88171394716906819191900992967790721244",
"171330181921549713615954239077365153555",
"155566312994499404241716463745966562182"
]
},
"id": "ASB-A-210469972-3543bd7a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/bde28d286e28b551dc9b11d882ad89120ac83107",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"138739927341858883135842305936694119996",
"148930798991672411555636361756158803493",
"56382636779656000685882344945188903705",
"175429779357791540357375360199795194414",
"65851841627463601732535770960670114535"
]
},
"id": "ASB-A-210469972-56870412",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/bde28d286e28b551dc9b11d882ad89120ac83107",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/BaseIDevicePolicyManager.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"165196328349436582360030923817994187530",
"142323484016314999817245832024741395750",
"45882653241144612024616399050563532720",
"151980662705061229486609346240039935145",
"190768989054067055310579774474829269827",
"201832238199760288917697888941600799034"
]
},
"id": "ASB-A-210469972-a71b7d9e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/bde28d286e28b551dc9b11d882ad89120ac83107",
"target": {
"file": "core/java/android/app/admin/DevicePolicyManager.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/bde28d286e28b551dc9b11d882ad89120ac83107"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 253.0,
"function_hash": "250093873334471829850819371941542205638"
},
"id": "ASB-A-210469972-326fe95e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/bd381d5a725a8b1a4c25035deadce7e0e6c10a63",
"target": {
"function": "finishAccountMigration",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 502.0,
"function_hash": "186000692122720881770078323657871377901"
},
"id": "ASB-A-210469972-400b8583",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/bd381d5a725a8b1a4c25035deadce7e0e6c10a63",
"target": {
"function": "finalizeProvisioningInPrimaryProfile",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 139.0,
"function_hash": "52020135773200354949955668133061458870"
},
"id": "ASB-A-210469972-8adfbf99",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/bd381d5a725a8b1a4c25035deadce7e0e6c10a63",
"target": {
"function": "handleFinalization",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"126770901287113181092994384759021439471",
"226949713720262975961857640617629134375",
"12750777737141886692112672794337740245",
"86786463719480147744044891942931028954",
"296931474696659612531751697753888668171",
"57888958134714656376978583733553612137",
"105048981573371348992613639911483961212",
"45645736765208385356595142875357394763",
"154411006352317980768647745974569241111",
"158476285602889413066203666655793104733",
"271805084136454864222455791023592820723",
"188300002174531764168902090990566839171",
"82210351836690846443513195538615440903",
"91888786414128127650247881244066864016",
"64020364376254899850364389227633984882",
"68728240398024612962387659027617384079",
"279724400294053524067234604311829065751",
"150619217421208424828847354377840103947",
"279861004617409870801295119533372596512",
"307603694352794879111688577822745804218",
"6907606922138334484371299075565236871",
"304910121156801056019843047824674174489",
"53584654036499175838198704377668676859",
"140429496537081717390233239429312066527",
"42801350699708305997946404542389117198",
"338276855435276441639946988279696297693",
"257596055235690513255623590287923532857",
"34792215023414834700817897323367957571",
"170153138462704580384084360720422733138",
"311741425933348699866359731845700924976",
"252687884198281453502597102940985632430",
"97037669992202532229136247253287127390",
"299431057903114398517986558811871730173",
"211966202988192482010646975831976079221",
"1261119691966196946321401272554284073",
"27486905656518721481345653258135179211",
"89390164303826736914226791737670002728",
"307603694352794879111688577822745804218",
"169153240682437419861430951779245499511"
]
},
"id": "ASB-A-210469972-a0835da8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/bd381d5a725a8b1a4c25035deadce7e0e6c10a63",
"target": {
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/bd381d5a725a8b1a4c25035deadce7e0e6c10a63"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"197890176130068902168067949037586548062",
"122699350965718965828571693357092858722",
"227204031875631927716967632590549745449",
"303497557041867154565069030362778323697",
"265440105236949901336631518345328609616",
"99153929003800529138819970572723873931",
"143201294867337278147875745487189655819",
"24443583605833590446008898529147896667",
"295747577431459138783214723720080232905",
"88171394716906819191900992967790721244",
"171330181921549713615954239077365153555",
"155566312994499404241716463745966562182"
]
},
"id": "ASB-A-210469972-1521a737",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b519b549fdb029dcdb6a51de944897e04e114e5f",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"176407345849482405224415113194502243251",
"80071093704165683181514205277162091730",
"130994207302516951127750300488159806100",
"265232164714520933154194555899870579667",
"77117659094043297473309897701643809649",
"306035216305799936985304480941400105538",
"250437971981451879089138580497689960133",
"60576818353731408722352150586936227483"
]
},
"id": "ASB-A-210469972-71ce4958",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b519b549fdb029dcdb6a51de944897e04e114e5f",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/BaseIDevicePolicyManager.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"165196328349436582360030923817994187530",
"142323484016314999817245832024741395750",
"45882653241144612024616399050563532720",
"151980662705061229486609346240039935145",
"190768989054067055310579774474829269827",
"201832238199760288917697888941600799034"
]
},
"id": "ASB-A-210469972-a8d72d72",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b519b549fdb029dcdb6a51de944897e04e114e5f",
"target": {
"file": "core/java/android/app/admin/DevicePolicyManager.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/b519b549fdb029dcdb6a51de944897e04e114e5f"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 458.0,
"function_hash": "37987703896448476434850992545770213883"
},
"id": "ASB-A-210469972-87d74a36",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/ae394d011d4cf575855a0cc3b5b65a3d8a6fe3ab",
"target": {
"function": "finalizeProvisioningInPrimaryProfile",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 139.0,
"function_hash": "52020135773200354949955668133061458870"
},
"id": "ASB-A-210469972-a38623f8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/ae394d011d4cf575855a0cc3b5b65a3d8a6fe3ab",
"target": {
"function": "handleFinalization",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"126770901287113181092994384759021439471",
"226949713720262975961857640617629134375",
"12750777737141886692112672794337740245",
"86786463719480147744044891942931028954",
"296931474696659612531751697753888668171",
"113840524066641097930110694512559626646",
"112974836930506796948169364416962663896",
"45645736765208385356595142875357394763",
"154411006352317980768647745974569241111",
"158476285602889413066203666655793104733",
"271805084136454864222455791023592820723",
"188300002174531764168902090990566839171",
"82210351836690846443513195538615440903",
"91888786414128127650247881244066864016",
"64020364376254899850364389227633984882",
"292511345032977434575265302305307313978",
"63364995101298375681430728124509883127",
"47726825992477006317929426726651698680",
"226502505189910148585409411286300231489",
"174622453199694226040593868429632318321",
"53584654036499175838198704377668676859",
"140429496537081717390233239429312066527",
"42801350699708305997946404542389117198",
"338276855435276441639946988279696297693"
]
},
"id": "ASB-A-210469972-bb2d7b02",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/ae394d011d4cf575855a0cc3b5b65a3d8a6fe3ab",
"target": {
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/ae394d011d4cf575855a0cc3b5b65a3d8a6fe3ab"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"197890176130068902168067949037586548062",
"122699350965718965828571693357092858722",
"227204031875631927716967632590549745449",
"303497557041867154565069030362778323697",
"265440105236949901336631518345328609616",
"99153929003800529138819970572723873931",
"143201294867337278147875745487189655819",
"24443583605833590446008898529147896667",
"295747577431459138783214723720080232905",
"88171394716906819191900992967790721244",
"171330181921549713615954239077365153555",
"155566312994499404241716463745966562182"
]
},
"id": "ASB-A-210469972-4373fc85",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b157e658a78d68c1f4d2a72d4a7b0aa39b1362ed",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"176407345849482405224415113194502243251",
"80071093704165683181514205277162091730",
"130994207302516951127750300488159806100",
"265232164714520933154194555899870579667",
"77117659094043297473309897701643809649",
"306035216305799936985304480941400105538",
"250437971981451879089138580497689960133",
"60576818353731408722352150586936227483"
]
},
"id": "ASB-A-210469972-4700d5d8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b157e658a78d68c1f4d2a72d4a7b0aa39b1362ed",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/BaseIDevicePolicyManager.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"165196328349436582360030923817994187530",
"142323484016314999817245832024741395750",
"45882653241144612024616399050563532720",
"151980662705061229486609346240039935145",
"190768989054067055310579774474829269827",
"201832238199760288917697888941600799034"
]
},
"id": "ASB-A-210469972-a5855873",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/b157e658a78d68c1f4d2a72d4a7b0aa39b1362ed",
"target": {
"file": "core/java/android/app/admin/DevicePolicyManager.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/b157e658a78d68c1f4d2a72d4a7b0aa39b1362ed"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 458.0,
"function_hash": "37987703896448476434850992545770213883"
},
"id": "ASB-A-210469972-505797d1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/1a7ef6ddd4c267323cd017c752d4da5392de0390",
"target": {
"function": "finalizeProvisioningInPrimaryProfile",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"126770901287113181092994384759021439471",
"226949713720262975961857640617629134375",
"12750777737141886692112672794337740245",
"86786463719480147744044891942931028954",
"296931474696659612531751697753888668171",
"113840524066641097930110694512559626646",
"112974836930506796948169364416962663896",
"45645736765208385356595142875357394763",
"154411006352317980768647745974569241111",
"158476285602889413066203666655793104733",
"271805084136454864222455791023592820723",
"188300002174531764168902090990566839171",
"82210351836690846443513195538615440903",
"91888786414128127650247881244066864016",
"64020364376254899850364389227633984882",
"292511345032977434575265302305307313978",
"63364995101298375681430728124509883127",
"47726825992477006317929426726651698680",
"226502505189910148585409411286300231489",
"174622453199694226040593868429632318321",
"53584654036499175838198704377668676859",
"140429496537081717390233239429312066527",
"42801350699708305997946404542389117198",
"338276855435276441639946988279696297693"
]
},
"id": "ASB-A-210469972-72ba5fdb",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/1a7ef6ddd4c267323cd017c752d4da5392de0390",
"target": {
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
},
{
"digest": {
"length": 139.0,
"function_hash": "52020135773200354949955668133061458870"
},
"id": "ASB-A-210469972-eb8b2039",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/1a7ef6ddd4c267323cd017c752d4da5392de0390",
"target": {
"function": "handleFinalization",
"file": "src/com/android/managedprovisioning/finalization/PrimaryProfileFinalizationHelper.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/1a7ef6ddd4c267323cd017c752d4da5392de0390"
],
"types": [
"EoP"
],
"spl": "2022-06-01",
"severity": "High"
}