ASB-A-310632322

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-310632322.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-310632322
Aliases
  • A-310632322
  • CVE-2025-26426
Published
2025-05-01T00:00:00Z
Modified
2025-05-05T15:32:46Z
Summary
[none]
Details

In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2025-05-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "78920828487289343444354263559440691708",
                    "161551587904927743660170258268839912466",
                    "299900998363379098184580588787617290862",
                    "96907630862398053829500626026911283495",
                    "25777738941556898659018170680846418808"
                ]
            },
            "id": "ASB-A-310632322-5343e828",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/0e91977c4ebfdfe4e2124373d22f99dfe211a06b",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/BroadcastController.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 8272.0,
                "function_hash": "113816175393555925411448803840263536782"
            },
            "id": "ASB-A-310632322-7fa6b466",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/0e91977c4ebfdfe4e2124373d22f99dfe211a06b",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/BroadcastController.java",
                "function": "registerReceiverWithFeatureTraced"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/0e91977c4ebfdfe4e2124373d22f99dfe211a06b"
    ],
    "spl": "2025-05-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-05-01

Affected versions

Other

15

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 8209.0,
                "function_hash": "146737399782776354467801637207932017577"
            },
            "id": "ASB-A-310632322-56a451aa",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/da489e4fb5c9f8f322538fb6877f971856e7787e",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeatureTraced"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "78920828487289343444354263559440691708",
                    "161551587904927743660170258268839912466",
                    "299900998363379098184580588787617290862",
                    "96907630862398053829500626026911283495",
                    "25777738941556898659018170680846418808"
                ]
            },
            "id": "ASB-A-310632322-712f3828",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/da489e4fb5c9f8f322538fb6877f971856e7787e",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "15"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "146920088912323429608733812733026184786",
                    "287155211863119620678037722781452293840",
                    "220727132240116226747682045160591348975",
                    "119627214757814213501603885775267073188"
                ]
            },
            "id": "ASB-A-310632322-c8f6ad22",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a49d3c13aac1aa7d258665e14d8e5cc2ff7638df",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 8173.0,
                "function_hash": "161232310663260284934164549120414750265"
            },
            "id": "ASB-A-310632322-e78c151b",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a49d3c13aac1aa7d258665e14d8e5cc2ff7638df",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeatureTraced"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/da489e4fb5c9f8f322538fb6877f971856e7787e",
        "https://android.googlesource.com/platform/frameworks/base/+/a49d3c13aac1aa7d258665e14d8e5cc2ff7638df"
    ],
    "spl": "2025-05-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-05-01

Affected versions

Other

13

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 6276.0,
                "function_hash": "94852590360102562081247224617585651546"
            },
            "id": "ASB-A-310632322-22b4eb3a",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/e690fb63636409ae64dcb88df4cc87c7c2850619",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeature"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 6312.0,
                "function_hash": "252149787302657495670487162934060411901"
            },
            "id": "ASB-A-310632322-42a5f962",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/1db6b990eaa47938c24063991c64e4ee608d362b",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeature"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "141290328006033960389295247434202981799",
                    "329741114504229128855395715588367363533",
                    "220727132240116226747682045160591348975",
                    "119627214757814213501603885775267073188"
                ]
            },
            "id": "ASB-A-310632322-4e8c97ac",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/e690fb63636409ae64dcb88df4cc87c7c2850619",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "14398641098436164184208260927304032713",
                    "161551587904927743660170258268839912466",
                    "299900998363379098184580588787617290862",
                    "96907630862398053829500626026911283495",
                    "25777738941556898659018170680846418808"
                ]
            },
            "id": "ASB-A-310632322-fc6f2a3b",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/1db6b990eaa47938c24063991c64e4ee608d362b",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/1db6b990eaa47938c24063991c64e4ee608d362b",
        "https://android.googlesource.com/platform/frameworks/base/+/e690fb63636409ae64dcb88df4cc87c7c2850619"
    ],
    "spl": "2025-05-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-05-01

Affected versions

Other

14

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "78920828487289343444354263559440691708",
                    "161551587904927743660170258268839912466",
                    "299900998363379098184580588787617290862",
                    "96907630862398053829500626026911283495",
                    "25777738941556898659018170680846418808"
                ]
            },
            "id": "ASB-A-310632322-1128f93c",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/3ae94b0da53aed63380263131795746b12296391",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 7857.0,
                "function_hash": "62315480724415764454310078696897008343"
            },
            "id": "ASB-A-310632322-85a427cd",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/3ae94b0da53aed63380263131795746b12296391",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeature"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "14"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "146920088912323429608733812733026184786",
                    "287155211863119620678037722781452293840",
                    "220727132240116226747682045160591348975",
                    "119627214757814213501603885775267073188"
                ]
            },
            "id": "ASB-A-310632322-e7096967",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/d1b79a295aa83e389b903c5354eb33e787801997",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 7821.0,
                "function_hash": "70884704147072818808108067781972915585"
            },
            "id": "ASB-A-310632322-ff6f96b6",
            "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/d1b79a295aa83e389b903c5354eb33e787801997",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "registerReceiverWithFeature"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/3ae94b0da53aed63380263131795746b12296391",
        "https://android.googlesource.com/platform/frameworks/base/+/d1b79a295aa83e389b903c5354eb33e787801997"
    ],
    "spl": "2025-05-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}