In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 123.0, "function_hash": "163713441365363912584104322234018597959" }, "id": "ASB-A-341253275-61bb2164", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "putIntoVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-6e956174", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "getFromVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-774c56eb", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "removeFromVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-9d25af69", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "listFromVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "89177565748140742846596485347557172665", "69672141588429440174389020656775169262", "121564297782914381017144410341357221508", "230925103545592616599657204099487323153", "90058151703523503278551915592415381970", "175313112128171833383782748455567757622", "210439795589587658505593487629836043476", "142085562056558224272608357421829156057", "170301652449558893383762645561964714134", "300105966508058651156827935224526542097", "237709588278930753572235568373351899711", "227860711991022564722990800753000739145", "237406576711083165168522472114623184734", "40632532675059611607213447171694335555", "142269596827539333111656844013432754992", "174873154413613534900568315555059939904", "62011651440939353198224124053480914172", "301496942145015685092192406822959832511", "234830734070820355563160105461540859399" ] }, "id": "ASB-A-341253275-c2a69a5b", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/a4919a563a38b2f28cf77b5cc3a8b1fb89b3d271" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-2b1c34ef", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "removeFromVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "89177565748140742846596485347557172665", "69672141588429440174389020656775169262", "121564297782914381017144410341357221508", "230925103545592616599657204099487323153", "90058151703523503278551915592415381970", "175313112128171833383782748455567757622", "210439795589587658505593487629836043476", "142085562056558224272608357421829156057", "170301652449558893383762645561964714134", "300105966508058651156827935224526542097", "237709588278930753572235568373351899711", "227860711991022564722990800753000739145", "237406576711083165168522472114623184734", "40632532675059611607213447171694335555", "142269596827539333111656844013432754992", "174873154413613534900568315555059939904", "62011651440939353198224124053480914172", "301496942145015685092192406822959832511", "234830734070820355563160105461540859399" ] }, "id": "ASB-A-341253275-38fdaf52", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java" }, "signature_type": "Line" }, { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-71d4a0f9", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "getFromVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "length": 123.0, "function_hash": "163713441365363912584104322234018597959" }, "id": "ASB-A-341253275-78c1416e", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "putIntoVpnProfileStore" }, "signature_type": "Function" }, { "digest": { "length": 91.0, "function_hash": "143716717230703658895682431182652211845" }, "id": "ASB-A-341253275-a3739a80", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/VpnManagerService.java", "function": "listFromVpnProfileStore" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/f1122ac36a2c9ffcb3ace49fc383870f87456c26" ], "spl": "2025-05-01", "severity": "High", "types": [ "ID" ] }