In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-ed74a3a9", "source": "https://android.googlesource.com/platform/frameworks/base/+/b9807f01748a669d738c94d6ad5319abea8608f5", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/b9807f01748a669d738c94d6ad5319abea8608f5" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-00e56745", "source": "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-1c8c425e", "source": "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-f9fe602e", "source": "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/7bf830ca0df71496cd47563e138b8712918e0476" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-1ba8bc3c", "source": "https://android.googlesource.com/platform/frameworks/base/+/3b93880c0b0052fe03c781a9768b81b098a353c0", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/3b93880c0b0052fe03c781a9768b81b098a353c0" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "227823936652301856122502748889614977771", "48767379213932465264492467471443513073", "22361778853781564523663172243309523508", "60088120690336731533818829860560442727" ] }, "id": "ASB-A-300903792-dbf1f5ca", "source": "https://android.googlesource.com/platform/frameworks/base/+/7cf363d1fe7c474120ae1c4a96c6adc4c8946d9f", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/7cf363d1fe7c474120ae1c4a96c6adc4c8946d9f" ], "spl": "2024-02-01", "severity": "High", "types": [ "EoP" ] }