ASB-A-317203980

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-317203980.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-317203980

Aliases

A-317203980
CVE-2025-22437

Published

2025-04-01T00:00:00Z

Modified

2025-11-04T16:30:24.675950Z

Summary

[none]

Details

In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

15-next:0

Fixed

15-next:2025-04-01

Affected versions

Other

15-next

Ecosystem specific

{
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2025-04-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4",
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "299081490920259318877727632521476767922",
                    "302472848972615289292183195072773805259",
                    "241865238823797463014263604621323504252",
                    "298315331419055250318672200793920101621",
                    "147614917347802771605840369520412201880",
                    "136949481901407557367519482498560956647",
                    "276394434875134967972949936602295470676",
                    "95684553906759592070313294543724405523",
                    "100404887466980931174629478934732371970",
                    "39429240874014650544371897720248906735",
                    "261979918624745673946407769660983652040",
                    "295816804738498243063969974468879949518",
                    "24545805705645075083901089211910123025"
                ],
                "threshold": 0.9
            },
            "match_only_versions": [
                "15-next"
            ],
            "id": "ASB-A-317203980-11ef2ff3",
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            }
        },
        {
            "deprecated": false,
            "signature_version": "v1",
            "digest": {
                "function_hash": "325366029875122455442385050112133143490",
                "length": 410.0
            },
            "target": {
                "function": "setMediaButtonReceiver",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "id": "ASB-A-317203980-39a6ea6d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4",
            "signature_type": "Function"
        },
        {
            "deprecated": false,
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "236770121537802621648311122075269459875",
                    "122654803527651144676053160484220879813",
                    "95741851566043158909238225212734541211",
                    "241886798512878965046143038112009769442",
                    "272603983022526998761392008370444589241",
                    "243149956597107806943455836161843096291",
                    "106995219572113423590683442444148216646",
                    "299958652213519946857433406139940572229",
                    "259415800374911855473008150984982785939"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "media/java/android/media/session/MediaSession.java"
            },
            "id": "ASB-A-317203980-49505b64",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4",
            "signature_type": "Line"
        },
        {
            "deprecated": false,
            "signature_version": "v1",
            "digest": {
                "function_hash": "8970144000333433291049366764681940003",
                "length": 184.0
            },
            "target": {
                "function": "setMediaButtonReceiver",
                "file": "media/java/android/media/session/MediaSession.java"
            },
            "id": "ASB-A-317203980-f4bf587c",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4",
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4"
    ]
}