In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Wifi/+/57e446cfdc95fce61be986d98ffc81e8bb70504a" ], "types": [ "EoP" ], "vanir_signatures": [ { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/57e446cfdc95fce61be986d98ffc81e8bb70504a", "digest": { "function_hash": "268970976256462892695824881419809576680", "length": 533.0 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java", "function": "validateIpConfiguration" }, "signature_version": "v1", "id": "ASB-A-349550024-02dbdc45", "signature_type": "Function" }, { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/57e446cfdc95fce61be986d98ffc81e8bb70504a", "digest": { "line_hashes": [ "157729514090136750614922102444868695211", "153223806101060587384917427341007894121", "6169354125247250972893225869952520317", "149175955344299535851433614057880762320", "283644712432518933007983254855582186844", "292297759700568290400317367960813353772", "215930143921313685355631054354498779599", "236446643928738427244331876479116847229", "62678524712933812997686960367221923736", "127112364178185815869358305186094565305", "240522512309630831697827857464120036961", "63023319149774050960125992398873200987" ], "threshold": 0.9 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java" }, "signature_version": "v1", "id": "ASB-A-349550024-896a4aa3", "signature_type": "Line" } ], "severity": "High", "spl": "2025-05-01" }
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Wifi/+/68e46661e2deb32b41527a02030cd928bee07409" ], "types": [ "EoP" ], "vanir_signatures": [ { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/68e46661e2deb32b41527a02030cd928bee07409", "digest": { "line_hashes": [ "157729514090136750614922102444868695211", "153223806101060587384917427341007894121", "6169354125247250972893225869952520317", "149175955344299535851433614057880762320", "283644712432518933007983254855582186844", "292297759700568290400317367960813353772", "215930143921313685355631054354498779599", "236446643928738427244331876479116847229", "62678524712933812997686960367221923736", "127112364178185815869358305186094565305", "240522512309630831697827857464120036961", "63023319149774050960125992398873200987" ], "threshold": 0.9 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java" }, "signature_version": "v1", "id": "ASB-A-349550024-97a91f59", "signature_type": "Line" }, { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/68e46661e2deb32b41527a02030cd928bee07409", "digest": { "function_hash": "268970976256462892695824881419809576680", "length": 533.0 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java", "function": "validateIpConfiguration" }, "signature_version": "v1", "id": "ASB-A-349550024-bfe3642f", "signature_type": "Function" } ], "severity": "High", "spl": "2025-05-01" }
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Wifi/+/28f7312aaed8fe503a7b929832712889d0f36e91" ], "types": [ "EoP" ], "vanir_signatures": [ { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/28f7312aaed8fe503a7b929832712889d0f36e91", "digest": { "line_hashes": [ "157729514090136750614922102444868695211", "153223806101060587384917427341007894121", "6169354125247250972893225869952520317", "149175955344299535851433614057880762320", "283644712432518933007983254855582186844", "292297759700568290400317367960813353772", "215930143921313685355631054354498779599", "236446643928738427244331876479116847229", "62678524712933812997686960367221923736", "127112364178185815869358305186094565305", "240522512309630831697827857464120036961", "63023319149774050960125992398873200987" ], "threshold": 0.9 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java" }, "signature_version": "v1", "id": "ASB-A-349550024-f56ab511", "signature_type": "Line" }, { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/28f7312aaed8fe503a7b929832712889d0f36e91", "digest": { "function_hash": "268970976256462892695824881419809576680", "length": 533.0 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java", "function": "validateIpConfiguration" }, "signature_version": "v1", "id": "ASB-A-349550024-fd5b13c3", "signature_type": "Function" } ], "severity": "High", "spl": "2025-05-01" }
{ "fixes": [ "https://android.googlesource.com/platform/packages/modules/Wifi/+/a7b08b4051be9b2e986a8f5686528b31e9c31723" ], "types": [ "EoP" ], "vanir_signatures": [ { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/a7b08b4051be9b2e986a8f5686528b31e9c31723", "digest": { "function_hash": "268970976256462892695824881419809576680", "length": 533.0 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java", "function": "validateIpConfiguration" }, "signature_version": "v1", "id": "ASB-A-349550024-ea71a7bc", "signature_type": "Function" }, { "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/a7b08b4051be9b2e986a8f5686528b31e9c31723", "digest": { "line_hashes": [ "157729514090136750614922102444868695211", "153223806101060587384917427341007894121", "6169354125247250972893225869952520317", "149175955344299535851433614057880762320", "283644712432518933007983254855582186844", "292297759700568290400317367960813353772", "215930143921313685355631054354498779599", "236446643928738427244331876479116847229", "62678524712933812997686960367221923736", "127112364178185815869358305186094565305", "240522512309630831697827857464120036961", "63023319149774050960125992398873200987" ], "threshold": 0.9 }, "deprecated": false, "target": { "file": "service/java/com/android/server/wifi/WifiConfigurationUtil.java" }, "signature_version": "v1", "id": "ASB-A-349550024-ff5e515d", "signature_type": "Line" } ], "severity": "High", "spl": "2025-05-01" }