In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 1021.0,
"function_hash": "44267952099852795945745403279417787116"
},
"id": "ASB-A-294104969-68f00462",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/084a7afb4bb41e0cdfdbe67bdd60728d940b4331",
"target": {
"function": "setListening",
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"303754758545901031315053932279936667687",
"179369087026665857653461905514250036049",
"280073471401331953840175590183702213769",
"138083083650702768372487772377500431835",
"62881756389589885982293259922463705233",
"272344389666115478536605592910331469022",
"97064714606841024654540877629919399578",
"330829465082715374033114998556180328452",
"295747577431459138783214723720080232905",
"60324878586981643617013299950150862577",
"192324834949022730068228180094440535415"
]
},
"id": "ASB-A-294104969-ed13f5c6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/084a7afb4bb41e0cdfdbe67bdd60728d940b4331",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/084a7afb4bb41e0cdfdbe67bdd60728d940b4331"
],
"types": [
"ID"
],
"spl": "2024-01-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101981006327478357457461249910970829546",
"179369087026665857653461905514250036049",
"280073471401331953840175590183702213769",
"138083083650702768372487772377500431835",
"62881756389589885982293259922463705233",
"272344389666115478536605592910331469022",
"97064714606841024654540877629919399578",
"330829465082715374033114998556180328452",
"295747577431459138783214723720080232905",
"60324878586981643617013299950150862577",
"192324834949022730068228180094440535415"
]
},
"id": "ASB-A-294104969-45d2dfa8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
},
{
"digest": {
"length": 1021.0,
"function_hash": "44267952099852795945745403279417787116"
},
"id": "ASB-A-294104969-d180ff55",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"function": "setListening",
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23"
],
"types": [
"ID"
],
"spl": "2024-01-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101981006327478357457461249910970829546",
"179369087026665857653461905514250036049",
"280073471401331953840175590183702213769",
"138083083650702768372487772377500431835",
"62881756389589885982293259922463705233",
"272344389666115478536605592910331469022",
"97064714606841024654540877629919399578",
"330829465082715374033114998556180328452",
"295747577431459138783214723720080232905",
"60324878586981643617013299950150862577",
"192324834949022730068228180094440535415"
]
},
"id": "ASB-A-294104969-3c049c20",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
},
{
"digest": {
"length": 1021.0,
"function_hash": "44267952099852795945745403279417787116"
},
"id": "ASB-A-294104969-d1e42f11",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"function": "setListening",
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23"
],
"types": [
"ID"
],
"spl": "2024-01-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101981006327478357457461249910970829546",
"179369087026665857653461905514250036049",
"280073471401331953840175590183702213769",
"138083083650702768372487772377500431835",
"62881756389589885982293259922463705233",
"272344389666115478536605592910331469022",
"97064714606841024654540877629919399578",
"330829465082715374033114998556180328452",
"295747577431459138783214723720080232905",
"60324878586981643617013299950150862577",
"192324834949022730068228180094440535415"
]
},
"id": "ASB-A-294104969-bf48d8e8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
},
{
"digest": {
"length": 1021.0,
"function_hash": "44267952099852795945745403279417787116"
},
"id": "ASB-A-294104969-f76b57f9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23",
"target": {
"function": "setListening",
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/dac02d61f8cf755f733ef6c2fbd0f939ea13ee23"
],
"types": [
"ID"
],
"spl": "2024-01-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 1021.0,
"function_hash": "44267952099852795945745403279417787116"
},
"id": "ASB-A-294104969-689adc90",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/12d0064ef788844afbb85ac7e65f8d4b1d37bc5c",
"target": {
"function": "setListening",
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"303754758545901031315053932279936667687",
"179369087026665857653461905514250036049",
"280073471401331953840175590183702213769",
"138083083650702768372487772377500431835",
"62881756389589885982293259922463705233",
"272344389666115478536605592910331469022",
"97064714606841024654540877629919399578",
"330829465082715374033114998556180328452",
"295747577431459138783214723720080232905",
"60324878586981643617013299950150862577",
"192324834949022730068228180094440535415"
]
},
"id": "ASB-A-294104969-703699ec",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/12d0064ef788844afbb85ac7e65f8d4b1d37bc5c",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/appops/AppOpsControllerImpl.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/12d0064ef788844afbb85ac7e65f8d4b1d37bc5c"
],
"types": [
"ID"
],
"spl": "2024-01-01",
"severity": "High"
}