In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "types": [ "EoP" ], "severity": "High", "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "206188904398887157952849569299816887768", "294715035373445758583643144815576799072", "160515729426048839210765872878504830984", "64249307036594502547115617933033992750", "31929445247905290476559195036969378820", "227227288452679631525890011656619600363", "157133681087591560378184964094355114139" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/798fa4b89e154877e4ddafc3894eb8275a74eb7e", "id": "ASB-A-228450832-4ff3c90f", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Line", "target": { "file": "src/com/android/providers/media/util/FileUtils.java" } }, { "digest": { "function_hash": "186571651556252326343810402849572478373", "length": 392.0 }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/798fa4b89e154877e4ddafc3894eb8275a74eb7e", "id": "ASB-A-228450832-8ca49847", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Function", "target": { "file": "src/com/android/providers/media/util/FileUtils.java", "function": "extractRelativePath" } } ], "fixes": [ "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/798fa4b89e154877e4ddafc3894eb8275a74eb7e" ], "spl": "2023-04-01" }
{ "types": [ "EoP" ], "severity": "High", "vanir_signatures": [ { "digest": { "function_hash": "186571651556252326343810402849572478373", "length": 392.0 }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/0f59f42685f186fd207355c01c580038436713ba", "id": "ASB-A-228450832-07b00f00", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Function", "target": { "file": "src/com/android/providers/media/util/FileUtils.java", "function": "extractRelativePath" } }, { "digest": { "threshold": 0.9, "line_hashes": [ "206188904398887157952849569299816887768", "294715035373445758583643144815576799072", "160515729426048839210765872878504830984", "64249307036594502547115617933033992750", "31929445247905290476559195036969378820", "327483409690538881822271074525609590913", "58494975484443663623447151996032049150" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/0f59f42685f186fd207355c01c580038436713ba", "id": "ASB-A-228450832-7e7e3db8", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Line", "target": { "file": "src/com/android/providers/media/util/FileUtils.java" } } ], "fixes": [ "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/0f59f42685f186fd207355c01c580038436713ba" ], "spl": "2023-04-01" }
{ "types": [ "EoP" ], "severity": "High", "vanir_signatures": [ { "digest": { "function_hash": "186571651556252326343810402849572478373", "length": 392.0 }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/43b718413e30fc2525bacfc4f9291e7998ad467d", "id": "ASB-A-228450832-a121c282", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Function", "target": { "file": "src/com/android/providers/media/util/FileUtils.java", "function": "extractRelativePath" } }, { "digest": { "threshold": 0.9, "line_hashes": [ "206188904398887157952849569299816887768", "294715035373445758583643144815576799072", "160515729426048839210765872878504830984", "64249307036594502547115617933033992750", "31929445247905290476559195036969378820", "216381434451874399883716768998548753683", "67285741456772442012070940876174401461" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/43b718413e30fc2525bacfc4f9291e7998ad467d", "id": "ASB-A-228450832-cb7efb17", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Line", "target": { "file": "src/com/android/providers/media/util/FileUtils.java" } } ], "fixes": [ "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/43b718413e30fc2525bacfc4f9291e7998ad467d" ], "spl": "2023-04-01" }
{ "types": [ "EoP" ], "severity": "High", "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "206188904398887157952849569299816887768", "294715035373445758583643144815576799072", "160515729426048839210765872878504830984", "64249307036594502547115617933033992750", "31929445247905290476559195036969378820", "216381434451874399883716768998548753683", "67285741456772442012070940876174401461" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cadac8cdf43ff1854da9b2013dd34f086df724d7", "id": "ASB-A-228450832-a383de1e", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Line", "target": { "file": "src/com/android/providers/media/util/FileUtils.java" } }, { "digest": { "function_hash": "186571651556252326343810402849572478373", "length": 392.0 }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cadac8cdf43ff1854da9b2013dd34f086df724d7", "id": "ASB-A-228450832-b0222b9d", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Function", "target": { "file": "src/com/android/providers/media/util/FileUtils.java", "function": "extractRelativePath" } } ], "fixes": [ "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cadac8cdf43ff1854da9b2013dd34f086df724d7" ], "spl": "2023-04-01" }
{ "types": [ "EoP" ], "severity": "High", "vanir_signatures": [ { "digest": { "function_hash": "186571651556252326343810402849572478373", "length": 392.0 }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/1426f04cd2b4940f9308432d37cc4ef79a7d8340", "id": "ASB-A-228450832-30167f3d", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Function", "target": { "file": "src/com/android/providers/media/util/FileUtils.java", "function": "extractRelativePath" } }, { "digest": { "threshold": 0.9, "line_hashes": [ "206188904398887157952849569299816887768", "294715035373445758583643144815576799072", "160515729426048839210765872878504830984", "64249307036594502547115617933033992750", "31929445247905290476559195036969378820", "227227288452679631525890011656619600363", "157133681087591560378184964094355114139" ] }, "signature_version": "v1", "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/1426f04cd2b4940f9308432d37cc4ef79a7d8340", "id": "ASB-A-228450832-317baae8", "deprecated": false, "exact_target_file_match_only": true, "signature_type": "Line", "target": { "file": "src/com/android/providers/media/util/FileUtils.java" } } ], "fixes": [ "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/1426f04cd2b4940f9308432d37cc4ef79a7d8340" ], "spl": "2023-04-01" }