In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791"
],
"spl": "2024-09-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791",
"target": {
"function": "isSettingsIntelligence",
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"function_hash": "49646114517670844042937875933788792519",
"length": 173.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-5668ec97"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791",
"target": {
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"179413845889125752530175021177621460968",
"266558139747049691078584970150005134678",
"79576826611508673350968040151376852571",
"193588792159829690721330465308736725722",
"332992864079410427741968853319326885154",
"139412047653254377956505464079301569276",
"241127285726442307560687631893542942641",
"126981589343675690273956754000629230622",
"326421904630898196673477653905958619819",
"196315165060527530870138670435984397007",
"310036226383176902663894537447642433105",
"148510165248147270704763745700619297730",
"228590528240610525256268413496387121733",
"189511285894089024137137210834220592454",
"109744489124236101591563579175974571090",
"27269575243651880212518305642821369607",
"58859435823822607643959794844423217504",
"243828400706052724467144771190204433376",
"288134624096398153050194223466694672988",
"263207314542187360100926568504983412845",
"66491215295740869903670050833238612515"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-624da7f9"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProvider.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"141077066423516902519557777870635818814",
"55196484001551965267472693861436541893",
"132467200435384676506214534803938104988",
"317589653566556190590632712472904434413"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-83df1924"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"85738271863788202094460117002907143449",
"104170172772291611936356207514061398121",
"224366934318121778659452979528875218383",
"275116089518188010455085766501635677511",
"41266076149665475049020247269823411090",
"72205384224724454603132566329240824313",
"166492132601027079472074562288529607543",
"17569895794553549162549667299148866049",
"179501211517473246624736902066495321261",
"257234656057867937982817617982410136505",
"336266310485904460243083515940455278127",
"292160822080694473103255461215858514851",
"70782116956485894441019547218086553588",
"75109932094293395523234522841265119194",
"16533397363385717381941819694505952733",
"106129675108308704250122795563092609431",
"293238324091350150431259787692499164763",
"262547224035814056909663146953945957106",
"216464432131356357092016970159312994305",
"301827005470445159947305169449102682198",
"127848188239353417087715568447583712353",
"2504056695247155826283436902267073833",
"69834721975884565717802950305695914332"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-8df3da47"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/901880a1d2e632179eb4ac708fc4bc18d9d50791",
"target": {
"function": "verifyLaunchSearchResultPageCaller",
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"function_hash": "113966886509538619603469606518164205107",
"length": 545.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-e7d638c3"
}
],
"types": [
"EoP"
]
}{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/b86569b274003e517bfd089cc7d6ba62d1c5f820"
],
"spl": "2024-09-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b86569b274003e517bfd089cc7d6ba62d1c5f820",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"85738271863788202094460117002907143449",
"104170172772291611936356207514061398121",
"224366934318121778659452979528875218383",
"275116089518188010455085766501635677511",
"41266076149665475049020247269823411090",
"72205384224724454603132566329240824313",
"166492132601027079472074562288529607543",
"17569895794553549162549667299148866049",
"179501211517473246624736902066495321261",
"257234656057867937982817617982410136505",
"336266310485904460243083515940455278127",
"292160822080694473103255461215858514851",
"70782116956485894441019547218086553588",
"75109932094293395523234522841265119194",
"16533397363385717381941819694505952733",
"106129675108308704250122795563092609431",
"293238324091350150431259787692499164763",
"262547224035814056909663146953945957106",
"216464432131356357092016970159312994305",
"301827005470445159947305169449102682198",
"127848188239353417087715568447583712353",
"2504056695247155826283436902267073833",
"69834721975884565717802950305695914332"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-204b3a34"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b86569b274003e517bfd089cc7d6ba62d1c5f820",
"target": {
"function": "verifyLaunchSearchResultPageCaller",
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"function_hash": "199518823100253805112452012657017307939",
"length": 544.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-2898418a"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b86569b274003e517bfd089cc7d6ba62d1c5f820",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProvider.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"141077066423516902519557777870635818814",
"55196484001551965267472693861436541893",
"132467200435384676506214534803938104988",
"317589653566556190590632712472904434413"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-7a20da67"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b86569b274003e517bfd089cc7d6ba62d1c5f820",
"target": {
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"227323086356080833877516244732967614630",
"257437597174148651989803755336875768020",
"111295409161946191683731364363122383528",
"20111600173423501753136164610726546766"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-c2cddfb1"
}
],
"types": [
"EoP"
]
}{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696"
],
"spl": "2024-09-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696",
"target": {
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"276618247427112812987413129460187461042",
"176009509192901602839265860322488745138",
"103766434882346259814728050165405437505",
"138896777871064624566621452784929765207",
"332992864079410427741968853319326885154",
"42381036445589068487420290780594090856",
"118704319522208327026979244481857438959",
"329891968633567264277128944601223553302",
"291468994314599955028428460854281525289",
"196315165060527530870138670435984397007",
"310036226383176902663894537447642433105",
"166456692149261701745376325468400234670",
"208913443421433609596733811668023376883",
"163723589470379848031663260717321828345",
"101869398777733669961233141308856094230",
"27269575243651880212518305642821369607",
"58859435823822607643959794844423217504",
"243828400706052724467144771190204433376",
"79921392830704193796897224707510801123",
"291017428247250659611331811226261452333",
"23141117065936772151373262045469282630"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-6cbcc052"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696",
"target": {
"function": "isSettingsIntelligence",
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"function_hash": "281541791069561701423093325493174575140",
"length": 178.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-ad2c4f4d"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"85738271863788202094460117002907143449",
"104170172772291611936356207514061398121",
"224366934318121778659452979528875218383",
"275116089518188010455085766501635677511",
"41266076149665475049020247269823411090",
"72205384224724454603132566329240824313",
"166492132601027079472074562288529607543",
"17569895794553549162549667299148866049",
"179501211517473246624736902066495321261",
"257234656057867937982817617982410136505",
"336266310485904460243083515940455278127",
"292160822080694473103255461215858514851",
"70782116956485894441019547218086553588",
"75109932094293395523234522841265119194",
"16533397363385717381941819694505952733",
"106129675108308704250122795563092609431",
"293238324091350150431259787692499164763",
"262547224035814056909663146953945957106",
"216464432131356357092016970159312994305",
"301827005470445159947305169449102682198",
"127848188239353417087715568447583712353",
"2504056695247155826283436902267073833",
"69834721975884565717802950305695914332"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-c34567e6"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696",
"target": {
"function": "verifyLaunchSearchResultPageCaller",
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"function_hash": "113966886509538619603469606518164205107",
"length": 545.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-c60d134a"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8bdbb580da847d82f16fb57883a01a5e65ffa696",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProvider.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"141077066423516902519557777870635818814",
"55196484001551965267472693861436541893",
"132467200435384676506214534803938104988",
"317589653566556190590632712472904434413"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-d007063d"
}
],
"types": [
"EoP"
]
}{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953"
],
"spl": "2024-09-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953",
"target": {
"function": "isSettingsIntelligence",
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"function_hash": "281541791069561701423093325493174575140",
"length": 178.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-05e5f192"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953",
"target": {
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"276618247427112812987413129460187461042",
"176009509192901602839265860322488745138",
"103766434882346259814728050165405437505",
"138896777871064624566621452784929765207",
"332992864079410427741968853319326885154",
"42381036445589068487420290780594090856",
"118704319522208327026979244481857438959",
"329891968633567264277128944601223553302",
"291468994314599955028428460854281525289",
"196315165060527530870138670435984397007",
"310036226383176902663894537447642433105",
"166456692149261701745376325468400234670",
"257219386988991007899645190187685347464",
"153851405559901314811122835734666604720",
"44490851872162224958513425042892937485",
"27269575243651880212518305642821369607",
"58859435823822607643959794844423217504",
"243828400706052724467144771190204433376",
"79921392830704193796897224707510801123",
"291017428247250659611331811226261452333",
"23141117065936772151373262045469282630"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-71f93d8e"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"85738271863788202094460117002907143449",
"104170172772291611936356207514061398121",
"224366934318121778659452979528875218383",
"275116089518188010455085766501635677511",
"41266076149665475049020247269823411090",
"72205384224724454603132566329240824313",
"166492132601027079472074562288529607543",
"17569895794553549162549667299148866049",
"179501211517473246624736902066495321261",
"257234656057867937982817617982410136505",
"336266310485904460243083515940455278127",
"292160822080694473103255461215858514851",
"70782116956485894441019547218086553588",
"75109932094293395523234522841265119194",
"16533397363385717381941819694505952733",
"106129675108308704250122795563092609431",
"293238324091350150431259787692499164763",
"262547224035814056909663146953945957106",
"216464432131356357092016970159312994305",
"301827005470445159947305169449102682198",
"127848188239353417087715568447583712353",
"2504056695247155826283436902267073833",
"69834721975884565717802950305695914332"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-85bcf8a7"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953",
"target": {
"function": "verifyLaunchSearchResultPageCaller",
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"function_hash": "113966886509538619603469606518164205107",
"length": 545.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-a768ce6f"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/c7a8127d3bb6010617e507c03f7207dd50082953",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProvider.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"141077066423516902519557777870635818814",
"55196484001551965267472693861436541893",
"132467200435384676506214534803938104988",
"317589653566556190590632712472904434413"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-fbc966f2"
}
],
"types": [
"EoP"
]
}{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a"
],
"spl": "2024-09-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a",
"target": {
"function": "verifyLaunchSearchResultPageCaller",
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"function_hash": "113966886509538619603469606518164205107",
"length": 545.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-0afb3d06"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProvider.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"141077066423516902519557777870635818814",
"55196484001551965267472693861436541893",
"132467200435384676506214534803938104988",
"317589653566556190590632712472904434413"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-26ab784e"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a",
"target": {
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"276618247427112812987413129460187461042",
"176009509192901602839265860322488745138",
"79576826611508673350968040151376852571",
"193588792159829690721330465308736725722",
"332992864079410427741968853319326885154",
"42381036445589068487420290780594090856",
"118704319522208327026979244481857438959",
"329891968633567264277128944601223553302",
"291468994314599955028428460854281525289",
"196315165060527530870138670435984397007",
"310036226383176902663894537447642433105",
"148510165248147270704763745700619297730",
"228590528240610525256268413496387121733",
"153851405559901314811122835734666604720",
"44490851872162224958513425042892937485",
"27269575243651880212518305642821369607",
"58859435823822607643959794844423217504",
"243828400706052724467144771190204433376",
"79921392830704193796897224707510801123",
"291017428247250659611331811226261452333",
"23141117065936772151373262045469282630"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-2a4caf89"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a",
"target": {
"file": "src/com/android/settings/search/SearchFeatureProviderImpl.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"85738271863788202094460117002907143449",
"104170172772291611936356207514061398121",
"224366934318121778659452979528875218383",
"275116089518188010455085766501635677511",
"41266076149665475049020247269823411090",
"72205384224724454603132566329240824313",
"166492132601027079472074562288529607543",
"17569895794553549162549667299148866049",
"179501211517473246624736902066495321261",
"257234656057867937982817617982410136505",
"336266310485904460243083515940455278127",
"292160822080694473103255461215858514851",
"70782116956485894441019547218086553588",
"75109932094293395523234522841265119194",
"16533397363385717381941819694505952733",
"106129675108308704250122795563092609431",
"293238324091350150431259787692499164763",
"262547224035814056909663146953945957106",
"216464432131356357092016970159312994305",
"301827005470445159947305169449102682198",
"127848188239353417087715568447583712353",
"2504056695247155826283436902267073833",
"69834721975884565717802950305695914332"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-333364513-36d72f76"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/ddc11bc03ab48e885f652b89df5f92ff283bcd4a",
"target": {
"function": "isSettingsIntelligence",
"file": "src/com/android/settings/search/SearchResultTrampoline.java"
},
"deprecated": false,
"digest": {
"function_hash": "281541791069561701423093325493174575140",
"length": 178.0
},
"signature_type": "Function",
"id": "ASB-A-333364513-7a2eab11"
}
],
"types": [
"EoP"
]
}