ASB-A-232798676

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-232798676.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-232798676
Aliases
  • A-232798676
  • CVE-2023-21351
Published
2024-08-01T00:00:00Z
Modified
2024-08-12T23:50:22Z
Summary
Start foreground activity from background via TextToSpeechService
Details

In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12:0
Fixed
12:2024-08-01

Affected versions

Other

12

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93299813471410581969135562935949905153",
                    "15472191267997321310275476709132526577",
                    "331422874673880489244790870663492104578",
                    "33723722171494134271822092619579944937"
                ]
            },
            "id": "ASB-A-232798676-13ba80e7",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "144008831271877775662079963192363386019",
                    "149565855102874764223428405739804773110",
                    "286166597539931852017663930028381477354",
                    "262188004735850955989416676751414883186"
                ]
            },
            "id": "ASB-A-232798676-2b098cfc",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 389.0,
                "function_hash": "8532100015852247629726694262108351871"
            },
            "id": "ASB-A-232798676-5c6328cc",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java",
                "function": "TextToSpeechSessionConnection"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "length": 551.0,
                "function_hash": "248991916340014374648342699255386558168"
            },
            "id": "ASB-A-232798676-5f36753b",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java",
                "function": "bind"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "74455769762697750460255520584522158894",
                    "132646460571437456104781522575404255177",
                    "8905393033166037666809215070796674938",
                    "158161077941656787118329839392027690945"
                ]
            },
            "id": "ASB-A-232798676-af529248",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "24864871434105128454340282503419934828",
                    "121243039367796971847175383063378041363",
                    "314498299160822359260625223032540822833",
                    "257354329809624862529202622426370759138"
                ]
            },
            "id": "ASB-A-232798676-cf2ce605",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "length": 197.0,
                "function_hash": "178154694252623401895496722196873171179"
            },
            "id": "ASB-A-232798676-d7ec3099",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java",
                "function": "connect"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "116626284343495268760957425476925002581",
                    "330980504914148740360309973183815087622",
                    "241767685514125665930956329372421081087",
                    "45926270977031310712186060351056412196",
                    "334425237711487289252441300952835309751",
                    "206724839735444028784137070382871675147",
                    "165827097755485229730906960766601865145",
                    "1449853733044119338181027052016044817"
                ]
            },
            "id": "ASB-A-232798676-d93c51cb",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "length": 583.0,
                "function_hash": "284769961671316759783773943984793267599"
            },
            "id": "ASB-A-232798676-e00b8ec1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java",
                "function": "ensureBound"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 4517.0,
                "function_hash": "219087430509146042353024614449936686070"
            },
            "id": "ASB-A-232798676-fa02ae78",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java",
                "function": "executeRunnableJob"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "259235494500818370210906025499202764482",
                    "34136816839363062996480202865251043571",
                    "696580132731913356371448635277988861",
                    "21853837409063633111980745404740668238"
                ]
            },
            "id": "ASB-A-232798676-fa06758f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/content/SyncManager.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf"
    ],
    "spl": "2024-08-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12L:0
Fixed
12L:2024-08-01

Affected versions

Other

12L

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "259235494500818370210906025499202764482",
                    "34136816839363062996480202865251043571",
                    "696580132731913356371448635277988861",
                    "21853837409063633111980745404740668238"
                ]
            },
            "id": "ASB-A-232798676-18240add",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/content/SyncManager.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "length": 583.0,
                "function_hash": "284769961671316759783773943984793267599"
            },
            "id": "ASB-A-232798676-3b708977",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java",
                "function": "ensureBound"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "74455769762697750460255520584522158894",
                    "132646460571437456104781522575404255177",
                    "8905393033166037666809215070796674938",
                    "158161077941656787118329839392027690945"
                ]
            },
            "id": "ASB-A-232798676-4cfa00cf",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "24864871434105128454340282503419934828",
                    "121243039367796971847175383063378041363",
                    "314498299160822359260625223032540822833",
                    "257354329809624862529202622426370759138"
                ]
            },
            "id": "ASB-A-232798676-4faacf11",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "144008831271877775662079963192363386019",
                    "149565855102874764223428405739804773110",
                    "286166597539931852017663930028381477354",
                    "262188004735850955989416676751414883186"
                ]
            },
            "id": "ASB-A-232798676-568308c4",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "length": 551.0,
                "function_hash": "248991916340014374648342699255386558168"
            },
            "id": "ASB-A-232798676-77821f5d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java",
                "function": "bind"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 389.0,
                "function_hash": "8532100015852247629726694262108351871"
            },
            "id": "ASB-A-232798676-7a320de3",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java",
                "function": "TextToSpeechSessionConnection"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "length": 197.0,
                "function_hash": "178154694252623401895496722196873171179"
            },
            "id": "ASB-A-232798676-8b408080",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java",
                "function": "connect"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 4517.0,
                "function_hash": "219087430509146042353024614449936686070"
            },
            "id": "ASB-A-232798676-b32ad1c7",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java",
                "function": "executeRunnableJob"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93299813471410581969135562935949905153",
                    "15472191267997321310275476709132526577",
                    "331422874673880489244790870663492104578",
                    "33723722171494134271822092619579944937"
                ]
            },
            "id": "ASB-A-232798676-d29ea20a",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "116626284343495268760957425476925002581",
                    "330980504914148740360309973183815087622",
                    "241767685514125665930956329372421081087",
                    "45926270977031310712186060351056412196",
                    "334425237711487289252441300952835309751",
                    "206724839735444028784137070382871675147",
                    "165827097755485229730906960766601865145",
                    "1449853733044119338181027052016044817"
                ]
            },
            "id": "ASB-A-232798676-d39d557f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf"
    ],
    "spl": "2024-08-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2024-08-01

Affected versions

Other

13

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "length": 197.0,
                "function_hash": "178154694252623401895496722196873171179"
            },
            "id": "ASB-A-232798676-09059ef4",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java",
                "function": "connect"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93299813471410581969135562935949905153",
                    "15472191267997321310275476709132526577",
                    "331422874673880489244790870663492104578",
                    "33723722171494134271822092619579944937"
                ]
            },
            "id": "ASB-A-232798676-0c86dc99",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "116626284343495268760957425476925002581",
                    "330980504914148740360309973183815087622",
                    "241767685514125665930956329372421081087",
                    "45926270977031310712186060351056412196",
                    "334425237711487289252441300952835309751",
                    "206724839735444028784137070382871675147",
                    "165827097755485229730906960766601865145",
                    "1449853733044119338181027052016044817"
                ]
            },
            "id": "ASB-A-232798676-1e22da2b",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "74455769762697750460255520584522158894",
                    "132646460571437456104781522575404255177",
                    "8905393033166037666809215070796674938",
                    "158161077941656787118329839392027690945"
                ]
            },
            "id": "ASB-A-232798676-24fdaf87",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "24864871434105128454340282503419934828",
                    "121243039367796971847175383063378041363",
                    "314498299160822359260625223032540822833",
                    "257354329809624862529202622426370759138"
                ]
            },
            "id": "ASB-A-232798676-2c8f58e7",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/speech/tts/TextToSpeech.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "length": 583.0,
                "function_hash": "284769961671316759783773943984793267599"
            },
            "id": "ASB-A-232798676-4612e492",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java",
                "function": "ensureBound"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "length": 551.0,
                "function_hash": "248991916340014374648342699255386558168"
            },
            "id": "ASB-A-232798676-4e59628f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java",
                "function": "bind"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "144008831271877775662079963192363386019",
                    "149565855102874764223428405739804773110",
                    "286166597539931852017663930028381477354",
                    "262188004735850955989416676751414883186"
                ]
            },
            "id": "ASB-A-232798676-5499ee01",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 4517.0,
                "function_hash": "219087430509146042353024614449936686070"
            },
            "id": "ASB-A-232798676-650fd274",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java",
                "function": "executeRunnableJob"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "259235494500818370210906025499202764482",
                    "34136816839363062996480202865251043571",
                    "696580132731913356371448635277988861",
                    "21853837409063633111980745404740668238"
                ]
            },
            "id": "ASB-A-232798676-741a7a85",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/content/SyncManager.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 389.0,
                "function_hash": "8532100015852247629726694262108351871"
            },
            "id": "ASB-A-232798676-cb4a4dc2",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java",
                "function": "TextToSpeechSessionConnection"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf"
    ],
    "spl": "2024-08-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}