In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 304.0,
"function_hash": "138408172717720399005558655763545125803"
},
"id": "ASB-A-244423101-36f9bc8b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f",
"target": {
"function": "onActivityCreated",
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"131725831959988992615949472794209487465",
"154908070120310378930732814843205591535",
"3735484112261496217320131088959465386",
"165492591298531419599767775461850476105",
"132937777261348651852835069151856471057",
"184118213769788426672050920711229916811",
"32707618715453424389089869013993625932",
"168975404747031868627182986266777942623",
"210329000274274397305027758091921182907",
"90365250968498219387023834309784250763",
"76898351523038350935301157678005746762",
"97428026333971879814295892821308776747"
]
},
"id": "ASB-A-244423101-48ab83ac",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f",
"target": {
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"252968638597356479528817582747575733537",
"102379073936580832809672027540023741771",
"243893183483786004222655025677543662890",
"257011765788636537184709652682173967172",
"101832766547206809195958755552155863782",
"202001993679985396524960184873124584732",
"50522660011902782084080795394864748678",
"6741800830642604463155091542609158498",
"205338521830289906035418972049449094852",
"144774728091313424467350516115645565092",
"282645872866265337077341551568528401143",
"308590161388588271317173991092333125992",
"336237888826733234811000060829406314950",
"79627703840093986007373463149170889366",
"243253031962318774563941161557973731829",
"153000652855426364788397932625596124896",
"84041416229149848937067921454503141204",
"330274446503237543892067509593866626221",
"55582678362007651393291753892087601008",
"118597789736520932820114966578462335787",
"260354832645280889720922893958489868499",
"319415237021722941502390374639922453361",
"183980863531000496672241071093692063296",
"307817317990939673577504120564973202169",
"15689573682105761334742255252507601623",
"179720680700273908699504340280163815733"
]
},
"id": "ASB-A-244423101-4a9b4607",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f",
"target": {
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 94.0,
"function_hash": "76171152919013290510411031794951847652"
},
"id": "ASB-A-244423101-8838e085",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f",
"target": {
"function": "onStop",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"length": 168.0,
"function_hash": "250505200074142491927505437655211126685"
},
"id": "ASB-A-244423101-b4df9434",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f",
"target": {
"function": "onStart",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/3cc8db3c58355d16956fdfbd6b2c7b030610f22f"
],
"types": [
"EoP"
],
"spl": "2023-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 401.0,
"function_hash": "123069456074599096701504075190221313001"
},
"id": "ASB-A-244423101-33caadf9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e",
"target": {
"function": "onActivityCreated",
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 168.0,
"function_hash": "250505200074142491927505437655211126685"
},
"id": "ASB-A-244423101-514c5292",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e",
"target": {
"function": "onStart",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"252968638597356479528817582747575733537",
"102379073936580832809672027540023741771",
"243893183483786004222655025677543662890",
"257011765788636537184709652682173967172",
"101832766547206809195958755552155863782",
"202001993679985396524960184873124584732",
"50522660011902782084080795394864748678",
"121743204651097864460930790204208198007",
"108720716903003497332659259489317123791",
"144774728091313424467350516115645565092",
"282645872866265337077341551568528401143",
"310960407903859100406308757672926449730",
"1812031911573902072063642339042837611",
"79627703840093986007373463149170889366",
"243253031962318774563941161557973731829",
"153000652855426364788397932625596124896",
"30252659446675248948895188232355414002",
"94730952668179073105522901144358223314",
"267114327912121280209714432493094131695",
"322341373800250462511846949368244240657",
"100775331750871751447220510908431139059",
"338239369729342983395532667588324854184",
"319415237021722941502390374639922453361",
"183980863531000496672241071093692063296",
"307817317990939673577504120564973202169",
"15689573682105761334742255252507601623",
"179720680700273908699504340280163815733"
]
},
"id": "ASB-A-244423101-57c61728",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e",
"target": {
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 94.0,
"function_hash": "76171152919013290510411031794951847652"
},
"id": "ASB-A-244423101-727ea73d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e",
"target": {
"function": "onStop",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"131725831959988992615949472794209487465",
"154908070120310378930732814843205591535",
"3735484112261496217320131088959465386",
"165492591298531419599767775461850476105",
"132937777261348651852835069151856471057",
"184118213769788426672050920711229916811",
"32707618715453424389089869013993625932",
"168975404747031868627182986266777942623",
"210329000274274397305027758091921182907",
"90365250968498219387023834309784250763",
"76898351523038350935301157678005746762",
"97428026333971879814295892821308776747"
]
},
"id": "ASB-A-244423101-754b1b28",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e",
"target": {
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/c55c060361bc7bae2e2f528e6e123933c7ba103e"
],
"types": [
"EoP"
],
"spl": "2023-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"131725831959988992615949472794209487465",
"154908070120310378930732814843205591535",
"3735484112261496217320131088959465386",
"165492591298531419599767775461850476105",
"132937777261348651852835069151856471057",
"184118213769788426672050920711229916811",
"32707618715453424389089869013993625932",
"168975404747031868627182986266777942623",
"210329000274274397305027758091921182907",
"90365250968498219387023834309784250763",
"76898351523038350935301157678005746762",
"97428026333971879814295892821308776747"
]
},
"id": "ASB-A-244423101-1b3842b0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b",
"target": {
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"252968638597356479528817582747575733537",
"102379073936580832809672027540023741771",
"243893183483786004222655025677543662890",
"257011765788636537184709652682173967172",
"101832766547206809195958755552155863782",
"202001993679985396524960184873124584732",
"50522660011902782084080795394864748678",
"121743204651097864460930790204208198007",
"108720716903003497332659259489317123791",
"144774728091313424467350516115645565092",
"282645872866265337077341551568528401143",
"310960407903859100406308757672926449730",
"1812031911573902072063642339042837611",
"79627703840093986007373463149170889366",
"243253031962318774563941161557973731829",
"153000652855426364788397932625596124896",
"30252659446675248948895188232355414002",
"94730952668179073105522901144358223314",
"267114327912121280209714432493094131695",
"322341373800250462511846949368244240657",
"100775331750871751447220510908431139059",
"338239369729342983395532667588324854184",
"319415237021722941502390374639922453361",
"183980863531000496672241071093692063296",
"307817317990939673577504120564973202169",
"15689573682105761334742255252507601623",
"179720680700273908699504340280163815733"
]
},
"id": "ASB-A-244423101-2881a9b8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b",
"target": {
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 401.0,
"function_hash": "123069456074599096701504075190221313001"
},
"id": "ASB-A-244423101-7d99a2ee",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b",
"target": {
"function": "onActivityCreated",
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 94.0,
"function_hash": "76171152919013290510411031794951847652"
},
"id": "ASB-A-244423101-a5ed51e0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b",
"target": {
"function": "onStop",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"length": 168.0,
"function_hash": "250505200074142491927505437655211126685"
},
"id": "ASB-A-244423101-e2e1607f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b",
"target": {
"function": "onStart",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/e644704beeb809bf5c8d629d4dc76aa8f6d16f3b"
],
"types": [
"EoP"
],
"spl": "2023-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"131725831959988992615949472794209487465",
"154908070120310378930732814843205591535",
"3735484112261496217320131088959465386",
"165492591298531419599767775461850476105",
"132937777261348651852835069151856471057",
"184118213769788426672050920711229916811",
"32707618715453424389089869013993625932",
"168975404747031868627182986266777942623",
"210329000274274397305027758091921182907",
"90365250968498219387023834309784250763",
"76898351523038350935301157678005746762",
"97428026333971879814295892821308776747"
]
},
"id": "ASB-A-244423101-0beec4ee",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029",
"target": {
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"252968638597356479528817582747575733537",
"102379073936580832809672027540023741771",
"243893183483786004222655025677543662890",
"257011765788636537184709652682173967172",
"101832766547206809195958755552155863782",
"202001993679985396524960184873124584732",
"50522660011902782084080795394864748678",
"121743204651097864460930790204208198007",
"108720716903003497332659259489317123791",
"144774728091313424467350516115645565092",
"282645872866265337077341551568528401143",
"310960407903859100406308757672926449730",
"1812031911573902072063642339042837611",
"79627703840093986007373463149170889366",
"243253031962318774563941161557973731829",
"153000652855426364788397932625596124896",
"30252659446675248948895188232355414002",
"94730952668179073105522901144358223314",
"267114327912121280209714432493094131695",
"322341373800250462511846949368244240657",
"100775331750871751447220510908431139059",
"338239369729342983395532667588324854184",
"319415237021722941502390374639922453361",
"183980863531000496672241071093692063296",
"307817317990939673577504120564973202169",
"15689573682105761334742255252507601623",
"179720680700273908699504340280163815733"
]
},
"id": "ASB-A-244423101-4b40ada5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029",
"target": {
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
},
{
"digest": {
"length": 94.0,
"function_hash": "76171152919013290510411031794951847652"
},
"id": "ASB-A-244423101-76f4c376",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029",
"target": {
"function": "onStop",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"length": 168.0,
"function_hash": "250505200074142491927505437655211126685"
},
"id": "ASB-A-244423101-9f74dd9f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029",
"target": {
"function": "onStart",
"file": "src/com/android/settings/bluetooth/BluetoothSwitchPreferenceController.java"
}
},
{
"digest": {
"length": 401.0,
"function_hash": "123069456074599096701504075190221313001"
},
"id": "ASB-A-244423101-b43d40bd",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029",
"target": {
"function": "onActivityCreated",
"file": "src/com/android/settings/connecteddevice/BluetoothDashboardFragment.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/cdbbd7bba4171033b864487f3da2fa26c843f029"
],
"types": [
"EoP"
],
"spl": "2023-02-01",
"severity": "High"
}