ASB-A-341688848

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-341688848.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-341688848
Aliases
  • A-341688848
  • CVE-2024-49722
Published
2025-04-01T00:00:00Z
Modified
2025-07-04T14:49:55.829990Z
Summary
[none]
Details

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15-next:0
Fixed
15-next:2025-04-01

Affected versions

Other

15-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e"
    ],
    "severity": "High",
    "types": [
        "ID"
    ],
    "spl": "2025-04-01",
    "vanir_signatures": [
        {
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java",
                "function": "showAvatarPicker"
            },
            "id": "ASB-A-341688848-3d59d7b2",
            "deprecated": false,
            "digest": {
                "function_hash": "66252267982984076039731208061947608083",
                "length": 418.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e",
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"
            },
            "id": "ASB-A-341688848-4ac682c4",
            "deprecated": false,
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "154770951609797451940987862552557479039",
                    "218270295055629904027070469533680274829",
                    "329718296283725824123553602088403096699",
                    "173836244179821243033474735718348316364",
                    "121546223260715733684130670385522693067",
                    "135193467781791317406752509003365463482",
                    "188036491421487214446849389566803674180",
                    "284029106079095197665407380999538471599"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e480e1892cafaff977e2ede68e5988eb732d098e",
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-04-01

Affected versions

Other

15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495",
        "https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922"
    ],
    "severity": "High",
    "types": [
        "ID"
    ],
    "spl": "2025-04-01",
    "vanir_signatures": [
        {
            "id": "ASB-A-341688848-0865610e",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922",
            "signature_version": "v1",
            "match_only_versions": [
                "15"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "21012297230397027758153145274893701940",
                    "57287418287093106570617455836807851378",
                    "38713462718029103542859251567200340265",
                    "328972366237784921290593555927293959860",
                    "183557868432084850548757929169437574650",
                    "105891697278902170243061600685028799279",
                    "138035147008356944918942224769818723366",
                    "220101719720662612098877797974864924290",
                    "33173686287185361422756979999976859090"
                ]
            },
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"
            },
            "signature_type": "Line"
        },
        {
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java",
                "function": "showAvatarPicker"
            },
            "id": "ASB-A-341688848-a058b735",
            "deprecated": false,
            "digest": {
                "function_hash": "66252267982984076039731208061947608083",
                "length": 418.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495",
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-341688848-b8093c0f",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2ab1084a748a2303289624e6063d2c60d10ec922",
            "signature_version": "v1",
            "match_only_versions": [
                "15"
            ],
            "digest": {
                "function_hash": "69932913096597948457968943615175847184",
                "length": 653.0
            },
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java",
                "function": "showAvatarPicker"
            },
            "signature_type": "Function"
        },
        {
            "target": {
                "file": "packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java"
            },
            "id": "ASB-A-341688848-b892010a",
            "deprecated": false,
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "154770951609797451940987862552557479039",
                    "218270295055629904027070469533680274829",
                    "329718296283725824123553602088403096699",
                    "173836244179821243033474735718348316364",
                    "121546223260715733684130670385522693067",
                    "135193467781791317406752509003365463482",
                    "188036491421487214446849389566803674180",
                    "284029106079095197665407380999538471599"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/4b731d5c8715190b88a44c443d5028b3014cd495",
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ]
}