In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
],
"spl": "2025-04-01",
"vanir_signatures": [
{
"signature_type": "Line",
"target": {
"file": "jni/FuseDaemon.cpp"
},
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
"id": "ASB-A-284989074-b6fb247e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"93842934062477710188903995703533913748",
"1278841832020020227939221192718275183",
"92394213477509476419682709966191767913",
"320949406496716361468834442309556421432"
]
}
}
]
}{
"types": [
"EoP"
],
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
],
"spl": "2025-04-01",
"vanir_signatures": [
{
"signature_type": "Line",
"target": {
"file": "jni/FuseDaemon.cpp"
},
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
"id": "ASB-A-284989074-fcbe1ddb",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"93842934062477710188903995703533913748",
"1278841832020020227939221192718275183",
"92394213477509476419682709966191767913",
"320949406496716361468834442309556421432"
]
}
}
]
}{
"types": [
"EoP"
],
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
],
"spl": "2025-04-01",
"vanir_signatures": [
{
"signature_type": "Line",
"target": {
"file": "jni/FuseDaemon.cpp"
},
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
"id": "ASB-A-284989074-3c5d5980",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"93842934062477710188903995703533913748",
"1278841832020020227939221192718275183",
"92394213477509476419682709966191767913",
"320949406496716361468834442309556421432"
]
}
}
]
}