ASB-A-324321147

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-324321147.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-324321147
Aliases
Published
2024-09-01T00:00:00Z
Modified
2025-10-23T15:57:26.264597Z
Summary
[none]
Details

In rebootRecoveryWithCommand of RecoverySystemService.java, there is a possible way to bypass a factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android

platform/build/soong

Package

Name
platform/build/soong

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2024-09-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/build/soong/+/c8170926f66853d4ff38e48c7af4ab9fdf0ae5ae"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2024-09-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/05b1440e06c84212b4353be7f5cbe97fd1bccafb"
    ]
}

platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2024-09-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/ea595e8e4f01272c0d2664bf7d7ec3710a697709"
    ]
}

platform/system/sepolicy

Package

Name
platform/system/sepolicy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2024-09-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/sepolicy/+/d157988ec5b5f057894fe7ff785f163291d9d767",
        "https://android.googlesource.com/platform/system/sepolicy/+/ca6c75b9572904b0bd8f9d06c8aff2f85e73e30e"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12:0
Fixed
12:2024-09-01

Affected versions

Other

12

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9cdf9eae2e02a6c3651379c33c4655368b009d13",
            "target": {
                "file": "keystore/java/android/security/AndroidKeyStoreMaintenance.java"
            },
            "id": "ASB-A-324321147-3bab63b3",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "215485146313622133872370603463836092731",
                    "205619386683574268652504478022636040735",
                    "235763321046038053102798807198667731616",
                    "7688259249438231920505158748089878033",
                    "118716778913461625128780261708081465621",
                    "315986714790696207876844379763168183773",
                    "240590361150340286664442456230007112536"
                ],
                "threshold": 0.9
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9cdf9eae2e02a6c3651379c33c4655368b009d13",
            "target": {
                "function": "rebootRecoveryWithCommand",
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-532bfe3f",
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1",
            "digest": {
                "function_hash": "139922616437392163507278178696116101270",
                "length": 286.0
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9cdf9eae2e02a6c3651379c33c4655368b009d13",
            "target": {
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-7ba59c14",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "290337205886082135664529271757085873662",
                    "44429003753278533918622652126628414746",
                    "95327427366099733971419211419415740775",
                    "193889559835343262853449875426062891055",
                    "52224330636178064851567392536525593756",
                    "34502311669572159593657740304219709331",
                    "248090791415092687519252799318411576738",
                    "275981375170790350061832965663579552572",
                    "335827388881238834665748622198376128843",
                    "4225917573281046722291225321582006865",
                    "23071830967478108637982025294452876294",
                    "4229832248663760137762095319238212756",
                    "34119448714758358513840952482255755156",
                    "692012383037161591342128733200314459",
                    "230973617615232794927698200478858730588",
                    "167845493303323722965697666503820776122",
                    "295029509456953677546158947474111980930",
                    "7882601665261321662698907659192602205",
                    "138761776906697323821268530347604769319",
                    "219182742916591629188321973430301238698",
                    "133865736767393987389982785909657267233",
                    "147530044308696879745964161830830661050",
                    "311420992284092135004605336394684948551"
                ],
                "threshold": 0.9
            }
        }
    ],
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/9cdf9eae2e02a6c3651379c33c4655368b009d13"
    ]
}

platform/system/sepolicy

Package

Name
platform/system/sepolicy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12:0
Fixed
12:2024-09-01

Affected versions

Other

12

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/sepolicy/+/837b024352038cb552b7c2473bf0707345550b78"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12L:0
Fixed
12L:2024-09-01

Affected versions

Other

12L

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1e81807b183f08c9b7a68d225afff8b9ffb60fbe",
            "target": {
                "function": "rebootRecoveryWithCommand",
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-1e92eb44",
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1",
            "digest": {
                "function_hash": "139922616437392163507278178696116101270",
                "length": 286.0
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1e81807b183f08c9b7a68d225afff8b9ffb60fbe",
            "target": {
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-4c850602",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "290337205886082135664529271757085873662",
                    "44429003753278533918622652126628414746",
                    "95327427366099733971419211419415740775",
                    "193889559835343262853449875426062891055",
                    "52224330636178064851567392536525593756",
                    "34502311669572159593657740304219709331",
                    "248090791415092687519252799318411576738",
                    "275981375170790350061832965663579552572",
                    "335827388881238834665748622198376128843",
                    "4225917573281046722291225321582006865",
                    "23071830967478108637982025294452876294",
                    "4229832248663760137762095319238212756",
                    "34119448714758358513840952482255755156",
                    "692012383037161591342128733200314459",
                    "230973617615232794927698200478858730588",
                    "167845493303323722965697666503820776122",
                    "295029509456953677546158947474111980930",
                    "7882601665261321662698907659192602205",
                    "138761776906697323821268530347604769319",
                    "219182742916591629188321973430301238698",
                    "133865736767393987389982785909657267233",
                    "147530044308696879745964161830830661050",
                    "311420992284092135004605336394684948551"
                ],
                "threshold": 0.9
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1e81807b183f08c9b7a68d225afff8b9ffb60fbe",
            "target": {
                "file": "keystore/java/android/security/AndroidKeyStoreMaintenance.java"
            },
            "id": "ASB-A-324321147-4fc6c413",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "215485146313622133872370603463836092731",
                    "205619386683574268652504478022636040735",
                    "235763321046038053102798807198667731616",
                    "7688259249438231920505158748089878033",
                    "118716778913461625128780261708081465621",
                    "315986714790696207876844379763168183773",
                    "240590361150340286664442456230007112536"
                ],
                "threshold": 0.9
            }
        }
    ],
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/1e81807b183f08c9b7a68d225afff8b9ffb60fbe"
    ]
}

platform/system/sepolicy

Package

Name
platform/system/sepolicy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12L:0
Fixed
12L:2024-09-01

Affected versions

Other

12L

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/sepolicy/+/844c799e6091c23d1dec8dc1a57b1c5c0f9ff7da"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2024-09-01

Affected versions

Other

13

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d020a38e4148a642e2f06363e27cce60097efa5d",
            "target": {
                "function": "rebootRecoveryWithCommand",
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-072802d5",
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1",
            "digest": {
                "function_hash": "139922616437392163507278178696116101270",
                "length": 286.0
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d020a38e4148a642e2f06363e27cce60097efa5d",
            "target": {
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-675a7557",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "290337205886082135664529271757085873662",
                    "44429003753278533918622652126628414746",
                    "95327427366099733971419211419415740775",
                    "193889559835343262853449875426062891055",
                    "52224330636178064851567392536525593756",
                    "34502311669572159593657740304219709331",
                    "248090791415092687519252799318411576738",
                    "275981375170790350061832965663579552572",
                    "335827388881238834665748622198376128843",
                    "4225917573281046722291225321582006865",
                    "23071830967478108637982025294452876294",
                    "4229832248663760137762095319238212756",
                    "34119448714758358513840952482255755156",
                    "692012383037161591342128733200314459",
                    "230973617615232794927698200478858730588",
                    "167845493303323722965697666503820776122",
                    "295029509456953677546158947474111980930",
                    "7882601665261321662698907659192602205",
                    "138761776906697323821268530347604769319",
                    "219182742916591629188321973430301238698",
                    "133865736767393987389982785909657267233",
                    "147530044308696879745964161830830661050",
                    "311420992284092135004605336394684948551"
                ],
                "threshold": 0.9
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d020a38e4148a642e2f06363e27cce60097efa5d",
            "target": {
                "file": "keystore/java/android/security/AndroidKeyStoreMaintenance.java"
            },
            "id": "ASB-A-324321147-98f2bc62",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "215485146313622133872370603463836092731",
                    "205619386683574268652504478022636040735",
                    "235763321046038053102798807198667731616",
                    "7688259249438231920505158748089878033",
                    "118716778913461625128780261708081465621",
                    "315986714790696207876844379763168183773",
                    "240590361150340286664442456230007112536"
                ],
                "threshold": 0.9
            }
        }
    ],
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/d020a38e4148a642e2f06363e27cce60097efa5d"
    ]
}

platform/system/sepolicy

Package

Name
platform/system/sepolicy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2024-09-01

Affected versions

Other

13

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/sepolicy/+/72313f580e19af6fbbe95187881c4771a0f2416b"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2024-09-01

Affected versions

Other

14

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c85d5febdc186f7fa1af2d0a6bdf705683437a98",
            "target": {
                "function": "rebootRecoveryWithCommand",
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-7cb96162",
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1",
            "digest": {
                "function_hash": "139922616437392163507278178696116101270",
                "length": 286.0
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c85d5febdc186f7fa1af2d0a6bdf705683437a98",
            "target": {
                "file": "services/core/java/com/android/server/recoverysystem/RecoverySystemService.java"
            },
            "id": "ASB-A-324321147-dabc2e75",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "290337205886082135664529271757085873662",
                    "44429003753278533918622652126628414746",
                    "95327427366099733971419211419415740775",
                    "193889559835343262853449875426062891055",
                    "234414802658805065033155889456798918156",
                    "243942422904347728247854685558340666159",
                    "94715560017765580375664593237494171610",
                    "253945846818432226472765210389068817276",
                    "335827388881238834665748622198376128843",
                    "4225917573281046722291225321582006865",
                    "23071830967478108637982025294452876294",
                    "4229832248663760137762095319238212756",
                    "34119448714758358513840952482255755156",
                    "692012383037161591342128733200314459",
                    "230973617615232794927698200478858730588",
                    "167845493303323722965697666503820776122",
                    "295029509456953677546158947474111980930",
                    "7882601665261321662698907659192602205",
                    "138761776906697323821268530347604769319",
                    "219182742916591629188321973430301238698",
                    "133865736767393987389982785909657267233",
                    "147530044308696879745964161830830661050",
                    "311420992284092135004605336394684948551"
                ],
                "threshold": 0.9
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c85d5febdc186f7fa1af2d0a6bdf705683437a98",
            "target": {
                "file": "keystore/java/android/security/AndroidKeyStoreMaintenance.java"
            },
            "id": "ASB-A-324321147-e0559c83",
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "215485146313622133872370603463836092731",
                    "205619386683574268652504478022636040735",
                    "235763321046038053102798807198667731616",
                    "7688259249438231920505158748089878033",
                    "118716778913461625128780261708081465621",
                    "315986714790696207876844379763168183773",
                    "240590361150340286664442456230007112536"
                ],
                "threshold": 0.9
            }
        }
    ],
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c85d5febdc186f7fa1af2d0a6bdf705683437a98"
    ]
}

platform/system/sepolicy

Package

Name
platform/system/sepolicy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2024-09-01

Affected versions

Other

14

Ecosystem specific 

{
    "spl": "2024-09-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/system/sepolicy/+/414d63d9d869912a12c23b19d273bccaa7b077d8"
    ]
}