In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "50361072087287655901888329471936174932", "121845403833178851004282735359276431864", "262251516898660165507780780419640996931", "105598966285062567154528998693568200516", "30174369586259591690482816430433378549", "204432403054961511955038099375169281483", "49833795518394411772161861300052649279", "27337898617899203000871999642392745760", "64739084715090043238196109301508449165", "156362479383866266865893582664059420791", "315453649490880073579904066497326411611", "257514193656426976875766054884252333199", "54638474997242602742890622500091766434", "196061202865139653099726819319029542276", "4792377229830908462556355398952756154" ] }, "id": "ASB-A-296915500-43b184dd", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5d66a17fa296117b44f23ae45ff7338cee6ae85", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java" }, "signature_type": "Line" }, { "digest": { "length": 6828.0, "function_hash": "310464502783358808731355411214931475372" }, "id": "ASB-A-296915500-fccfac47", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5d66a17fa296117b44f23ae45ff7338cee6ae85", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java", "function": "generateFileInfo" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b5d66a17fa296117b44f23ae45ff7338cee6ae85" ], "spl": "2025-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "length": 3536.0, "function_hash": "3343094387847156907146336674838837384" }, "id": "ASB-A-296915500-3c233f45", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5bcfd347823f1d3893d843db2286f2013923fad8", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java", "function": "generateFileInfo" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "189014771623161666538395564364398214511", "121845403833178851004282735359276431864", "262251516898660165507780780419640996931", "105598966285062567154528998693568200516", "317359883940541754133914101727535757081", "204432403054961511955038099375169281483", "49833795518394411772161861300052649279", "27337898617899203000871999642392745760", "139406057071785338861518184548622748508", "89636947875856846358939766277269167282", "315453649490880073579904066497326411611", "257514193656426976875766054884252333199", "54638474997242602742890622500091766434", "196061202865139653099726819319029542276", "4792377229830908462556355398952756154" ] }, "id": "ASB-A-296915500-6591a5d9", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5bcfd347823f1d3893d843db2286f2013923fad8", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5bcfd347823f1d3893d843db2286f2013923fad8" ], "spl": "2025-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "189014771623161666538395564364398214511", "121845403833178851004282735359276431864", "262251516898660165507780780419640996931", "105598966285062567154528998693568200516", "30174369586259591690482816430433378549", "204432403054961511955038099375169281483", "49833795518394411772161861300052649279", "27337898617899203000871999642392745760", "139406057071785338861518184548622748508", "89636947875856846358939766277269167282", "315453649490880073579904066497326411611", "257514193656426976875766054884252333199", "54638474997242602742890622500091766434", "196061202865139653099726819319029542276", "4792377229830908462556355398952756154" ] }, "id": "ASB-A-296915500-3c1e17aa", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c5add83a18d87ea4a46bc8ab7f675e32c8d6a56", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java" }, "signature_type": "Line" }, { "digest": { "length": 3726.0, "function_hash": "183911023901520138653190158611739293803" }, "id": "ASB-A-296915500-ab9d67f2", "source": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c5add83a18d87ea4a46bc8ab7f675e32c8d6a56", "deprecated": false, "signature_version": "v1", "target": { "file": "android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java", "function": "generateFileInfo" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2c5add83a18d87ea4a46bc8ab7f675e32c8d6a56" ], "spl": "2025-04-01", "severity": "High", "types": [ "ID" ] }