In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "setRingtoneUri" }, "signature_version": "v1", "digest": { "length": 251.0, "function_hash": "133031434479216099194307905452406260201" }, "id": "ASB-A-325030433-1c6cfd11", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "getRingTonePreference" }, "signature_version": "v1", "digest": { "length": 296.0, "function_hash": "306687027296355637922132806271758282101" }, "id": "ASB-A-325030433-48b184da", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "248671716584057300785462213278131389134", "263515044525166302535215884960551402106", "279921214816236382063408277335479350610", "75959860967272893104544807511879207729", "250192583294005125257913726570220402478", "58838851214741234154771278895414228819", "152005111570825911847066526519511613284", "18337771855077075187570844051959333783", "14769223577195532185019027311875908450", "177951331207846869576424443456142754959", "258400268766178781577269273409943615382", "278688330813352352868510681390862952067", "253415492431726145069546772472895670183", "172695401327264267241615279259175691141", "238051197396264627135955887937578994219", "67539921850361608969104389796797552858", "259475632868274863456527577971635323897", "305691977004525890984829261053864051", "216290257123844451646771943976359675110", "271437640484680005869636960705871224356", "3274114120089772416315707768767429794", "180147887889154742401429707933158294619", "125430637473330956441203003579781052746", "95500207018634963090715657447010122062", "162021703766761516144788973274417396627", "252538717735571485483837766430479159769", "329941963891357385557172251545687632370", "152919738203697197512909211769250164626" ] }, "id": "ASB-A-325030433-6545df58", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java", "function": "migrateVoicemailNotificationSettings" }, "signature_version": "v1", "digest": { "length": 581.0, "function_hash": "71679360428432379506423741355863132513" }, "id": "ASB-A-325030433-8e84a11b", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "154236477835906654517993517806808105038", "113444643295855590800201893739480848443", "174051193066396634707122360605385417157", "106049811260593264175438614703638396776", "299630838548443073013715267021770912032", "289359924979266531862205035438719540820", "100249978342859389425886031064290288606", "308635386750701990348137436806048872029", "7936512274775870169851420279471967701", "331849017987102178318115310637151247351", "161031963099252491738342096228047382642", "27520099346840307313956488025617925505", "241074073288632596402560024690577478300", "173710053643114438002372541439012670502" ] }, "id": "ASB-A-325030433-ede803ae", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" } ], "types": [ "ID" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20" ] }
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "getRingTonePreference" }, "signature_version": "v1", "digest": { "length": 296.0, "function_hash": "306687027296355637922132806271758282101" }, "id": "ASB-A-325030433-20392c89", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "248671716584057300785462213278131389134", "263515044525166302535215884960551402106", "279921214816236382063408277335479350610", "75959860967272893104544807511879207729", "250192583294005125257913726570220402478", "58838851214741234154771278895414228819", "152005111570825911847066526519511613284", "18337771855077075187570844051959333783", "14769223577195532185019027311875908450", "177951331207846869576424443456142754959", "258400268766178781577269273409943615382", "278688330813352352868510681390862952067", "253415492431726145069546772472895670183", "172695401327264267241615279259175691141", "238051197396264627135955887937578994219", "67539921850361608969104389796797552858", "259475632868274863456527577971635323897", "305691977004525890984829261053864051", "216290257123844451646771943976359675110", "271437640484680005869636960705871224356", "3274114120089772416315707768767429794", "180147887889154742401429707933158294619", "125430637473330956441203003579781052746", "95500207018634963090715657447010122062", "162021703766761516144788973274417396627", "252538717735571485483837766430479159769", "329941963891357385557172251545687632370", "152919738203697197512909211769250164626" ] }, "id": "ASB-A-325030433-22411b9a", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "154236477835906654517993517806808105038", "113444643295855590800201893739480848443", "174051193066396634707122360605385417157", "106049811260593264175438614703638396776", "299630838548443073013715267021770912032", "289359924979266531862205035438719540820", "100249978342859389425886031064290288606", "308635386750701990348137436806048872029", "7936512274775870169851420279471967701", "331849017987102178318115310637151247351", "161031963099252491738342096228047382642", "27520099346840307313956488025617925505", "241074073288632596402560024690577478300", "173710053643114438002372541439012670502" ] }, "id": "ASB-A-325030433-3a6b7cf6", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java", "function": "migrateVoicemailNotificationSettings" }, "signature_version": "v1", "digest": { "length": 581.0, "function_hash": "71679360428432379506423741355863132513" }, "id": "ASB-A-325030433-3d405cf6", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "setRingtoneUri" }, "signature_version": "v1", "digest": { "length": 251.0, "function_hash": "133031434479216099194307905452406260201" }, "id": "ASB-A-325030433-6d0a81bd", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" } ], "types": [ "ID" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14" ] }
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "248671716584057300785462213278131389134", "263515044525166302535215884960551402106", "279921214816236382063408277335479350610", "75959860967272893104544807511879207729", "250192583294005125257913726570220402478", "58838851214741234154771278895414228819", "152005111570825911847066526519511613284", "18337771855077075187570844051959333783", "14769223577195532185019027311875908450", "177951331207846869576424443456142754959", "258400268766178781577269273409943615382", "278688330813352352868510681390862952067", "253415492431726145069546772472895670183", "172695401327264267241615279259175691141", "238051197396264627135955887937578994219", "67539921850361608969104389796797552858", "259475632868274863456527577971635323897", "305691977004525890984829261053864051", "216290257123844451646771943976359675110", "271437640484680005869636960705871224356", "3274114120089772416315707768767429794", "180147887889154742401429707933158294619", "125430637473330956441203003579781052746", "95500207018634963090715657447010122062", "162021703766761516144788973274417396627", "252538717735571485483837766430479159769", "329941963891357385557172251545687632370", "152919738203697197512909211769250164626" ] }, "id": "ASB-A-325030433-0304bb8a", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "setRingtoneUri" }, "signature_version": "v1", "digest": { "length": 251.0, "function_hash": "133031434479216099194307905452406260201" }, "id": "ASB-A-325030433-0b867f4c", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java", "function": "migrateVoicemailNotificationSettings" }, "signature_version": "v1", "digest": { "length": 581.0, "function_hash": "71679360428432379506423741355863132513" }, "id": "ASB-A-325030433-67eec83c", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "154236477835906654517993517806808105038", "113444643295855590800201893739480848443", "174051193066396634707122360605385417157", "106049811260593264175438614703638396776", "299630838548443073013715267021770912032", "289359924979266531862205035438719540820", "100249978342859389425886031064290288606", "308635386750701990348137436806048872029", "7936512274775870169851420279471967701", "331849017987102178318115310637151247351", "161031963099252491738342096228047382642", "27520099346840307313956488025617925505", "241074073288632596402560024690577478300", "173710053643114438002372541439012670502" ] }, "id": "ASB-A-325030433-6cfc6ad2", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "getRingTonePreference" }, "signature_version": "v1", "digest": { "length": 296.0, "function_hash": "306687027296355637922132806271758282101" }, "id": "ASB-A-325030433-90cbfbaf", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" } ], "types": [ "ID" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf" ] }
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java", "function": "migrateVoicemailNotificationSettings" }, "signature_version": "v1", "digest": { "length": 581.0, "function_hash": "71679360428432379506423741355863132513" }, "id": "ASB-A-325030433-4a7e548b", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "248671716584057300785462213278131389134", "263515044525166302535215884960551402106", "279921214816236382063408277335479350610", "75959860967272893104544807511879207729", "250192583294005125257913726570220402478", "58838851214741234154771278895414228819", "152005111570825911847066526519511613284", "18337771855077075187570844051959333783", "14769223577195532185019027311875908450", "177951331207846869576424443456142754959", "258400268766178781577269273409943615382", "278688330813352352868510681390862952067", "253415492431726145069546772472895670183", "172695401327264267241615279259175691141", "238051197396264627135955887937578994219", "67539921850361608969104389796797552858", "259475632868274863456527577971635323897", "305691977004525890984829261053864051", "216290257123844451646771943976359675110", "271437640484680005869636960705871224356", "3274114120089772416315707768767429794", "180147887889154742401429707933158294619", "125430637473330956441203003579781052746", "95500207018634963090715657447010122062", "162021703766761516144788973274417396627", "252538717735571485483837766430479159769", "329941963891357385557172251545687632370", "152919738203697197512909211769250164626" ] }, "id": "ASB-A-325030433-4eb3e323", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "getRingTonePreference" }, "signature_version": "v1", "digest": { "length": 296.0, "function_hash": "306687027296355637922132806271758282101" }, "id": "ASB-A-325030433-53739c96", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "154236477835906654517993517806808105038", "113444643295855590800201893739480848443", "174051193066396634707122360605385417157", "106049811260593264175438614703638396776", "299630838548443073013715267021770912032", "289359924979266531862205035438719540820", "100249978342859389425886031064290288606", "308635386750701990348137436806048872029", "7936512274775870169851420279471967701", "331849017987102178318115310637151247351", "161031963099252491738342096228047382642", "27520099346840307313956488025617925505", "241074073288632596402560024690577478300", "173710053643114438002372541439012670502" ] }, "id": "ASB-A-325030433-b766ed02", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "setRingtoneUri" }, "signature_version": "v1", "digest": { "length": 251.0, "function_hash": "133031434479216099194307905452406260201" }, "id": "ASB-A-325030433-db7a1955", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" } ], "types": [ "ID" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e" ] }
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "getRingTonePreference" }, "signature_version": "v1", "digest": { "length": 296.0, "function_hash": "306687027296355637922132806271758282101" }, "id": "ASB-A-325030433-144d4562", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java", "function": "migrateVoicemailNotificationSettings" }, "signature_version": "v1", "digest": { "length": 581.0, "function_hash": "71679360428432379506423741355863132513" }, "id": "ASB-A-325030433-2a6b061a", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "248671716584057300785462213278131389134", "263515044525166302535215884960551402106", "279921214816236382063408277335479350610", "75959860967272893104544807511879207729", "250192583294005125257913726570220402478", "58838851214741234154771278895414228819", "152005111570825911847066526519511613284", "18337771855077075187570844051959333783", "14769223577195532185019027311875908450", "177951331207846869576424443456142754959", "258400268766178781577269273409943615382", "278688330813352352868510681390862952067", "253415492431726145069546772472895670183", "172695401327264267241615279259175691141", "238051197396264627135955887937578994219", "67539921850361608969104389796797552858", "259475632868274863456527577971635323897", "305691977004525890984829261053864051", "216290257123844451646771943976359675110", "271437640484680005869636960705871224356", "3274114120089772416315707768767429794", "180147887889154742401429707933158294619", "125430637473330956441203003579781052746", "95500207018634963090715657447010122062", "162021703766761516144788973274417396627", "252538717735571485483837766430479159769", "329941963891357385557172251545687632370", "152919738203697197512909211769250164626" ] }, "id": "ASB-A-325030433-5d4ea2e7", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" }, { "signature_type": "Function", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java", "function": "setRingtoneUri" }, "signature_version": "v1", "digest": { "length": 251.0, "function_hash": "133031434479216099194307905452406260201" }, "id": "ASB-A-325030433-7013d694", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" }, { "signature_type": "Line", "deprecated": false, "target": { "file": "src/java/com/android/internal/telephony/util/NotificationChannelController.java" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "154236477835906654517993517806808105038", "113444643295855590800201893739480848443", "174051193066396634707122360605385417157", "106049811260593264175438614703638396776", "299630838548443073013715267021770912032", "289359924979266531862205035438719540820", "100249978342859389425886031064290288606", "308635386750701990348137436806048872029", "7936512274775870169851420279471967701", "331849017987102178318115310637151247351", "161031963099252491738342096228047382642", "27520099346840307313956488025617925505", "241074073288632596402560024690577478300", "173710053643114438002372541439012670502" ] }, "id": "ASB-A-325030433-eb3281aa", "source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" } ], "types": [ "ID" ], "severity": "High", "spl": "2025-09-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b" ] }