In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"severity": "Moderate",
"spl": "2022-10-01",
"vanir_signatures": [
{
"signature_type": "Function",
"digest": {
"length": 1337.0,
"function_hash": "268709947457808782884596182483301889944"
},
"id": "ASB-A-231322873-83350a3d",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java",
"function": "shouldHeadsUp"
}
},
{
"signature_type": "Function",
"digest": {
"length": 1068.0,
"function_hash": "302805064868753769474438572865928628369"
},
"id": "ASB-A-231322873-85a060af",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java",
"function": "handleFullScreenIntent"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"21940031268955891227493674901624752295",
"235586351066527852661551508291587105388",
"241689917641917854826184097706341259288",
"224251774399045252105721997222205892340",
"199121957812317939254904450573611658596"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-d01aba2a",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"1747795920082813673810050641646648625",
"245373561216564314408407729898523497141",
"79303652884614057329397731234630098621",
"45756085378735733059965536294186124766",
"26721156531583433665178872941127841904",
"259517971268462732898062030377347592705",
"96566401647609796946539463968098915370",
"101232710443763646319066923481578182089",
"893820694871671961193647853042026145",
"102218621015709428499015363826812275521",
"335592471619252541168490349011359568829",
"15983894647188451408510615384266884668",
"241493822973618713146030928487831495652",
"70349766751275827442435830157860638553",
"274000608261375659659963782313269591027",
"223967102018963825188038630474094567296",
"236686065813650549054735002670714375539"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-dfb78ee0",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java"
}
}
],
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1"
]
}{
"severity": "Moderate",
"spl": "2022-10-01",
"vanir_signatures": [
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"15002384506786101120514745214771865555",
"248444117079812531491354465915514282623",
"281204685032213872646242640783182908345",
"329123499263948383715934258951774098410",
"249897533707904935156699186749365988203",
"44950183582803653591395062160694249906",
"101232710443763646319066923481578182089",
"893820694871671961193647853042026145",
"102218621015709428499015363826812275521",
"335592471619252541168490349011359568829",
"15983894647188451408510615384266884668",
"241493822973618713146030928487831495652",
"70349766751275827442435830157860638553",
"274000608261375659659963782313269591027",
"155562803589524482155381748983214650660",
"33158359675856764532101126667861144325"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-9cc7c81b",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"
}
},
{
"signature_type": "Function",
"digest": {
"length": 207.0,
"function_hash": "240837714206259610946521637483419433199"
},
"id": "ASB-A-231322873-c6fa1995",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldLaunchFullScreenIntentWhenAdded"
}
},
{
"signature_type": "Function",
"digest": {
"length": 1775.0,
"function_hash": "285468308528632235203795036305709164543"
},
"id": "ASB-A-231322873-e9d3848c",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldHeadsUpWhenAwake"
}
}
],
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"
]
}{
"severity": "Moderate",
"spl": "2022-10-01",
"vanir_signatures": [
{
"signature_type": "Function",
"digest": {
"length": 207.0,
"function_hash": "240837714206259610946521637483419433199"
},
"id": "ASB-A-231322873-36e1fd7e",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldLaunchFullScreenIntentWhenAdded"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"15002384506786101120514745214771865555",
"248444117079812531491354465915514282623",
"281204685032213872646242640783182908345",
"329123499263948383715934258951774098410",
"249897533707904935156699186749365988203",
"44950183582803653591395062160694249906",
"101232710443763646319066923481578182089",
"893820694871671961193647853042026145",
"102218621015709428499015363826812275521",
"335592471619252541168490349011359568829",
"15983894647188451408510615384266884668",
"241493822973618713146030928487831495652",
"70349766751275827442435830157860638553",
"274000608261375659659963782313269591027",
"155562803589524482155381748983214650660",
"33158359675856764532101126667861144325"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-7b212fa6",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"
}
},
{
"signature_type": "Function",
"digest": {
"length": 1775.0,
"function_hash": "285468308528632235203795036305709164543"
},
"id": "ASB-A-231322873-d9c6d03d",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldHeadsUpWhenAwake"
}
}
],
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"
]
}{
"severity": "Moderate",
"spl": "2022-10-01",
"vanir_signatures": [
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"15002384506786101120514745214771865555",
"248444117079812531491354465915514282623",
"281204685032213872646242640783182908345",
"329123499263948383715934258951774098410",
"249897533707904935156699186749365988203",
"44950183582803653591395062160694249906",
"101232710443763646319066923481578182089",
"893820694871671961193647853042026145",
"102218621015709428499015363826812275521",
"335592471619252541168490349011359568829",
"15983894647188451408510615384266884668",
"241493822973618713146030928487831495652",
"70349766751275827442435830157860638553",
"274000608261375659659963782313269591027",
"155562803589524482155381748983214650660",
"33158359675856764532101126667861144325"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-1d6b3324",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"
}
},
{
"signature_type": "Function",
"digest": {
"length": 207.0,
"function_hash": "240837714206259610946521637483419433199"
},
"id": "ASB-A-231322873-418ef490",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldLaunchFullScreenIntentWhenAdded"
}
},
{
"signature_type": "Function",
"digest": {
"length": 1775.0,
"function_hash": "285468308528632235203795036305709164543"
},
"id": "ASB-A-231322873-97ab88b3",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldHeadsUpWhenAwake"
}
}
],
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"
]
}{
"severity": "Moderate",
"spl": "2022-10-01",
"vanir_signatures": [
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"15002384506786101120514745214771865555",
"248444117079812531491354465915514282623",
"281204685032213872646242640783182908345",
"329123499263948383715934258951774098410",
"249897533707904935156699186749365988203",
"44950183582803653591395062160694249906",
"40939851882067743232961579552057137269",
"893820694871671961193647853042026145",
"102218621015709428499015363826812275521",
"335592471619252541168490349011359568829",
"15983894647188451408510615384266884668",
"241493822973618713146030928487831495652",
"70349766751275827442435830157860638553",
"274000608261375659659963782313269591027",
"60090026026213295029440159738967821272",
"195848382315310501926053252634053978473"
],
"threshold": 0.9
},
"id": "ASB-A-231322873-0941f59e",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"
}
},
{
"signature_type": "Function",
"digest": {
"length": 1198.0,
"function_hash": "79101331109160012015592815747739171993"
},
"id": "ASB-A-231322873-cc8b30e4",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldHeadsUpWhenAwake"
}
},
{
"signature_type": "Function",
"digest": {
"length": 207.0,
"function_hash": "240837714206259610946521637483419433199"
},
"id": "ASB-A-231322873-d5552b31",
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java",
"function": "shouldLaunchFullScreenIntentWhenAdded"
}
}
],
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32"
]
}