ASB-A-365975561

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-365975561.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-365975561
Aliases
  • A-365975561
  • CVE-2025-48552
Published
2025-09-01T00:00:00Z
Modified
2025-09-02T14:59:13.694122Z
Summary
[none]
Details

In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-09-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "201633379875360665646869455272688402449",
                    "288601726329186386117510990504054772970",
                    "196997335450530709465077362757979950488",
                    "273751660295431841883684583117337769054",
                    "329191942919032605567954151777017913869",
                    "59960503925704668785743406738583040666",
                    "75851719969231313971657831443700341877"
                ]
            },
            "id": "ASB-A-365975561-b9010149",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472"
        },
        {
            "signature_type": "Function",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "saveGlobalProxyLocked"
            },
            "signature_version": "v1",
            "digest": {
                "length": 802.0,
                "function_hash": "43049679245358985349852202327242378119"
            },
            "id": "ASB-A-365975561-c97cd23e",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472"
        }
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/2ea32931ef9a06a762b8cf21584f156140672472"
    ],
    "spl": "2025-09-01"
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-09-01

Affected versions

Other

15

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Function",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "saveGlobalProxyLocked"
            },
            "signature_version": "v1",
            "digest": {
                "length": 835.0,
                "function_hash": "49639378997988961016167459904804225271"
            },
            "id": "ASB-A-365975561-240a793d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109"
        },
        {
            "signature_type": "Line",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "260532600982899483790208317464426921261",
                    "235764991148192914396330519255368466877",
                    "179295908367442358274145847198729870664",
                    "176689909264972438874061989468456471732",
                    "330404221401735496573702290612688553395",
                    "281434450182866316697680142586399258748",
                    "75851719969231313971657831443700341877"
                ]
            },
            "id": "ASB-A-365975561-94af1e50",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109"
        }
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/bdd8fbba5bfa3f0c6ea838e1882ad394100a8109"
    ],
    "spl": "2025-09-01"
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-09-01

Affected versions

Other

16

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Function",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "saveGlobalProxyLocked"
            },
            "signature_version": "v1",
            "digest": {
                "length": 802.0,
                "function_hash": "43049679245358985349852202327242378119"
            },
            "id": "ASB-A-365975561-aecf4c19",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6"
        },
        {
            "signature_type": "Line",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "201633379875360665646869455272688402449",
                    "288601726329186386117510990504054772970",
                    "196997335450530709465077362757979950488",
                    "273751660295431841883684583117337769054",
                    "329191942919032605567954151777017913869",
                    "59960503925704668785743406738583040666",
                    "75851719969231313971657831443700341877"
                ]
            },
            "id": "ASB-A-365975561-aeedccdb",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6"
        }
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/2658e2f12b660e81f8baccd98bcf41a693145ed6"
    ],
    "spl": "2025-09-01"
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-09-01

Affected versions

Other

13

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Function",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "saveGlobalProxyLocked"
            },
            "signature_version": "v1",
            "digest": {
                "length": 835.0,
                "function_hash": "49639378997988961016167459904804225271"
            },
            "id": "ASB-A-365975561-c65c7f7d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
        },
        {
            "signature_type": "Line",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "260532600982899483790208317464426921261",
                    "235764991148192914396330519255368466877",
                    "179295908367442358274145847198729870664",
                    "176689909264972438874061989468456471732",
                    "330404221401735496573702290612688553395",
                    "281434450182866316697680142586399258748",
                    "75851719969231313971657831443700341877"
                ]
            },
            "id": "ASB-A-365975561-de0cc158",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
        }
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
    ],
    "spl": "2025-09-01"
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-09-01

Affected versions

Other

14

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "260532600982899483790208317464426921261",
                    "235764991148192914396330519255368466877",
                    "179295908367442358274145847198729870664",
                    "176689909264972438874061989468456471732",
                    "330404221401735496573702290612688553395",
                    "281434450182866316697680142586399258748",
                    "75851719969231313971657831443700341877"
                ]
            },
            "id": "ASB-A-365975561-096ea95c",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
        },
        {
            "signature_type": "Function",
            "deprecated": false,
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "saveGlobalProxyLocked"
            },
            "signature_version": "v1",
            "digest": {
                "length": 835.0,
                "function_hash": "49639378997988961016167459904804225271"
            },
            "id": "ASB-A-365975561-e0c98f4f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
        }
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/ca2faa1036823e23907f2836d4893a1daf11202c"
    ],
    "spl": "2025-09-01"
}