In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/c38cc3e355718577192da8f544d21fd0be5f6be2",
"deprecated": false,
"digest": {
"line_hashes": [
"246736969903961248768856468089465496499",
"271066176364576696574212824870146655696",
"169612276757878199159430454346714318775",
"136451155866723700102138077185458788978",
"113064725819461971995773807080904735155",
"284118772713736719105755961722201759506",
"48057973676723036455536917885284645777",
"116998670455463778636723357404361079241",
"308121788007053366508215908483055684009",
"124078872087738476097860903202903656236",
"256011917474104462537798266994122794582",
"258743691555999430252099968108426230399",
"136737830891931770264013653669469632959",
"312943758035996511700587694718898083554",
"105950252668671054026008991290823669554",
"172985491674973394162389928344571908017",
"296280120694515538694202314746126647790",
"74653315976142247346789020840011538070"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-12dc3059",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/AlarmManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/c010da3a4649a02afe256cbf6dad475c2278059b",
"deprecated": false,
"digest": {
"line_hashes": [
"217487944899938329389616071693482969107",
"76560598688685798486655165111017155763",
"177437416490083445555720288934605248886",
"174558481477812847606007898567074284893",
"239950423001084119070329157568127618365",
"82519098739493333549495035112677755479",
"44680857751872954833294761294868243287",
"230306714543084073275221465745943258420"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-69d51584",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/AlarmManagerService.java",
"function": "setImpl"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/c010da3a4649a02afe256cbf6dad475c2278059b",
"deprecated": false,
"digest": {
"function_hash": "19886702699348811170725616393373645896",
"length": 2523.0
},
"id": "ASB-A-234441463-7f285b3c",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "snoozeLocked"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/c38cc3e355718577192da8f544d21fd0be5f6be2",
"deprecated": false,
"digest": {
"function_hash": "218022517417475734090118918500764227599",
"length": 643.0
},
"id": "ASB-A-234441463-8644b09b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/SnoozeHelper.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/c38cc3e355718577192da8f544d21fd0be5f6be2",
"deprecated": false,
"digest": {
"line_hashes": [
"273651856757059191523230081303242045380",
"185556418595223759316711170446585621440",
"178371216858907602245073680698707192804",
"337243511578395489734568170043716677872",
"192192325131464320465864309656260771890",
"196916979129126459730086355383189451300",
"119621803812147201870708281443368929862"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-d3ccfc33",
"signature_type": "Line"
}
],
"types": [
"DoS"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/c010da3a4649a02afe256cbf6dad475c2278059b",
"https://android.googlesource.com/platform/frameworks/base/+/c38cc3e355718577192da8f544d21fd0be5f6be2"
],
"spl": "2022-11-01",
"severity": "High"
}{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "snoozeLocked"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/455a525421ea3748172d84a2529b9d993491a28f",
"deprecated": false,
"digest": {
"function_hash": "112654050601641781797526351044294372909",
"length": 733.0
},
"id": "ASB-A-234441463-2114d27a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/SnoozeHelper.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/455a525421ea3748172d84a2529b9d993491a28f",
"deprecated": false,
"digest": {
"line_hashes": [
"144259619628895940052253852996348581214",
"167751129965517498601490292517005615266",
"255431367479510548098509845067030806001",
"241712283690988152011112993670378995540",
"113483160989905229319599777861268174426",
"37048983232642789480628101857523059563"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-42ad1b42",
"signature_type": "Line"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217487944899938329389616071693482969107",
"76560598688685798486655165111017155763",
"177437416490083445555720288934605248886",
"174558481477812847606007898567074284893",
"201308111027318231989927503857835599202",
"139842379503772870018629235738315026171",
"243647773963036923760992040967065423210",
"230306714543084073275221465745943258420"
],
"threshold": 0.9
},
"target": {
"file": "services/core/java/com/android/server/AlarmManagerService.java"
},
"signature_version": "v1",
"match_only_versions": [
"11"
],
"source": "https://android.googlesource.com/platform/frameworks/base/+/909251a2caf1a8734c7e3a43794399ab3d15ac76",
"id": "ASB-A-234441463-4c863cbd",
"signature_type": "Line"
},
{
"deprecated": false,
"digest": {
"function_hash": "217392875032781907864616060453632132076",
"length": 2704.0
},
"target": {
"file": "services/core/java/com/android/server/AlarmManagerService.java",
"function": "setImpl"
},
"signature_version": "v1",
"match_only_versions": [
"11"
],
"source": "https://android.googlesource.com/platform/frameworks/base/+/909251a2caf1a8734c7e3a43794399ab3d15ac76",
"id": "ASB-A-234441463-5d543a63",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/455a525421ea3748172d84a2529b9d993491a28f",
"deprecated": false,
"digest": {
"line_hashes": [
"246736969903961248768856468089465496499",
"187698618253809582736305774244703468354",
"16876056235280384785433567297388230720",
"299990419091874023650652866545696689322",
"318480374409126001254724550490539290896",
"29979324858346101566224649569356981440",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"312943758035996511700587694718898083554",
"264448848544464867907050414032353733330",
"140523261557535289688944366261592094074",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"69822740004942007737916798991301776861",
"287943585983500785334555499376810846266",
"179325102082196402235796728375524201961",
"274558978505290173946126633529712777676",
"38133813462041371046387511819406221669"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-d9066b4a",
"signature_type": "Line"
}
],
"types": [
"DoS"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/455a525421ea3748172d84a2529b9d993491a28f",
"https://android.googlesource.com/platform/frameworks/base/+/909251a2caf1a8734c7e3a43794399ab3d15ac76"
],
"spl": "2022-11-01",
"severity": "High"
}{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "snoozeLocked"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/bc808de2f8a88e76fde0b6d033b4a232aebff8cb",
"deprecated": false,
"digest": {
"function_hash": "112654050601641781797526351044294372909",
"length": 733.0
},
"id": "ASB-A-234441463-1b9a7cdf",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/SnoozeHelper.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/bc808de2f8a88e76fde0b6d033b4a232aebff8cb",
"deprecated": false,
"digest": {
"line_hashes": [
"144259619628895940052253852996348581214",
"167751129965517498601490292517005615266",
"255431367479510548098509845067030806001",
"241712283690988152011112993670378995540",
"113483160989905229319599777861268174426",
"37048983232642789480628101857523059563"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-897cbb7b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java",
"function": "setImpl"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab",
"deprecated": false,
"digest": {
"function_hash": "144427921223261310449910182971667580505",
"length": 2962.0
},
"id": "ASB-A-234441463-cd86c9e1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/bc808de2f8a88e76fde0b6d033b4a232aebff8cb",
"deprecated": false,
"digest": {
"line_hashes": [
"246736969903961248768856468089465496499",
"187698618253809582736305774244703468354",
"16876056235280384785433567297388230720",
"299990419091874023650652866545696689322",
"318480374409126001254724550490539290896",
"29979324858346101566224649569356981440",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"312943758035996511700587694718898083554",
"264448848544464867907050414032353733330",
"140523261557535289688944366261592094074",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"69822740004942007737916798991301776861",
"287943585983500785334555499376810846266",
"179325102082196402235796728375524201961",
"274558978505290173946126633529712777676",
"38133813462041371046387511819406221669"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-f2e590f9",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab",
"deprecated": false,
"digest": {
"line_hashes": [
"194960529492108937475159913050840156303",
"132696898332258803845389891854353824129",
"274344669976942146868054411584992772072",
"227300836756619477833450094607499384658",
"64720660952305090899139623393735643263",
"157496762567856612724517949478063580325",
"338498939677404765710852354035292108934",
"169086527677765459152082330424639988506"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-fb4d4953",
"signature_type": "Line"
}
],
"types": [
"DoS"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab",
"https://android.googlesource.com/platform/frameworks/base/+/bc808de2f8a88e76fde0b6d033b4a232aebff8cb"
],
"spl": "2022-11-01",
"severity": "High"
}{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "snoozeLocked"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e61de0648abdd37883aed7851d7cf1f2463f448a",
"deprecated": false,
"digest": {
"function_hash": "112654050601641781797526351044294372909",
"length": 733.0
},
"id": "ASB-A-234441463-6d17d7fa",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e61de0648abdd37883aed7851d7cf1f2463f448a",
"deprecated": false,
"digest": {
"line_hashes": [
"246736969903961248768856468089465496499",
"187698618253809582736305774244703468354",
"16876056235280384785433567297388230720",
"299990419091874023650652866545696689322",
"318480374409126001254724550490539290896",
"29979324858346101566224649569356981440",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"312943758035996511700587694718898083554",
"264448848544464867907050414032353733330",
"140523261557535289688944366261592094074",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"69822740004942007737916798991301776861",
"287943585983500785334555499376810846266",
"179325102082196402235796728375524201961",
"274558978505290173946126633529712777676",
"38133813462041371046387511819406221669"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-759fa975",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java",
"function": "setImpl"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab",
"deprecated": false,
"digest": {
"function_hash": "144427921223261310449910182971667580505",
"length": 2962.0
},
"id": "ASB-A-234441463-8a3e3b0a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/SnoozeHelper.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e61de0648abdd37883aed7851d7cf1f2463f448a",
"deprecated": false,
"digest": {
"line_hashes": [
"230409930210903602044017784431967837666",
"78799031629076392340238098144296734806",
"281094859749110593287885372315658437742",
"241712283690988152011112993670378995540",
"113483160989905229319599777861268174426",
"37048983232642789480628101857523059563"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-b7479ac6",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab",
"deprecated": false,
"digest": {
"line_hashes": [
"194960529492108937475159913050840156303",
"132696898332258803845389891854353824129",
"274344669976942146868054411584992772072",
"227300836756619477833450094607499384658",
"64720660952305090899139623393735643263",
"157496762567856612724517949478063580325",
"338498939677404765710852354035292108934",
"169086527677765459152082330424639988506"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-f67c7b62",
"signature_type": "Line"
}
],
"types": [
"DoS"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/e61de0648abdd37883aed7851d7cf1f2463f448a",
"https://android.googlesource.com/platform/frameworks/base/+/87fd506129631225581de641c4dd9956a15aa0ab"
],
"spl": "2022-11-01",
"severity": "High"
}{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/2100d275644575214a8e74457bb973b44a3bacff",
"deprecated": false,
"digest": {
"line_hashes": [
"194960529492108937475159913050840156303",
"132696898332258803845389891854353824129",
"274344669976942146868054411584992772072",
"227300836756619477833450094607499384658",
"64720660952305090899139623393735643263",
"157496762567856612724517949478063580325",
"338498939677404765710852354035292108934",
"169086527677765459152082330424639988506"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-20b43a72",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e2ceb6acfae4daa6fb095ca4031324f9f4d0fa96",
"deprecated": false,
"digest": {
"line_hashes": [
"246736969903961248768856468089465496499",
"187698618253809582736305774244703468354",
"16876056235280384785433567297388230720",
"299990419091874023650652866545696689322",
"318480374409126001254724550490539290896",
"29979324858346101566224649569356981440",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"312943758035996511700587694718898083554",
"264448848544464867907050414032353733330",
"140523261557535289688944366261592094074",
"22863707140187505080850984725039061117",
"73460645893941252595838037635436996006",
"69822740004942007737916798991301776861",
"287943585983500785334555499376810846266",
"179325102082196402235796728375524201961",
"274558978505290173946126633529712777676",
"38133813462041371046387511819406221669"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-4f3e9674",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/NotificationManagerService.java",
"function": "snoozeLocked"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e2ceb6acfae4daa6fb095ca4031324f9f4d0fa96",
"deprecated": false,
"digest": {
"function_hash": "112654050601641781797526351044294372909",
"length": 733.0
},
"id": "ASB-A-234441463-7660ed82",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "apex/jobscheduler/service/java/com/android/server/alarm/AlarmManagerService.java",
"function": "setImpl"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/2100d275644575214a8e74457bb973b44a3bacff",
"deprecated": false,
"digest": {
"function_hash": "144427921223261310449910182971667580505",
"length": 2962.0
},
"id": "ASB-A-234441463-bc63c428",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "services/core/java/com/android/server/notification/SnoozeHelper.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/e2ceb6acfae4daa6fb095ca4031324f9f4d0fa96",
"deprecated": false,
"digest": {
"line_hashes": [
"230409930210903602044017784431967837666",
"78799031629076392340238098144296734806",
"281094859749110593287885372315658437742",
"241712283690988152011112993670378995540",
"113483160989905229319599777861268174426",
"37048983232642789480628101857523059563"
],
"threshold": 0.9
},
"id": "ASB-A-234441463-c7aeacb1",
"signature_type": "Line"
}
],
"types": [
"DoS"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/2100d275644575214a8e74457bb973b44a3bacff",
"https://android.googlesource.com/platform/frameworks/base/+/e2ceb6acfae4daa6fb095ca4031324f9f4d0fa96"
],
"spl": "2022-11-01",
"severity": "High"
}