In isSafeIntent of AccountManagerService.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 1377.0,
"function_hash": "338350863036102985394706704282023021029"
},
"id": "ASB-A-366401629-7bd8169a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"275136482310096949223314165621352716840",
"8115445310509100908857167739662128042",
"253441721171165215243821755830095971678",
"88776566412728272429447891863167717932",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-97f8a3b3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 379.0,
"function_hash": "249159885145870363150402675264162571837"
},
"id": "ASB-A-366401629-a646b22c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-e1ee7f63",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 322.0,
"function_hash": "205161867117239727942345407947753384515"
},
"id": "ASB-A-366401629-3ee63a8b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 1306.0,
"function_hash": "320241958175093881091290427079770006414"
},
"id": "ASB-A-366401629-4b373237",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-b3430fb8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293101183722590943478867740640679466749",
"108412991053796078583091860813531505642",
"28035893926855174962940746953580967671",
"40112860432468891969057084409714236080",
"177480183194004016276858230791931740979",
"172276761039711939950469013439173632504",
"101497221201453250963401664882264014271",
"38057727491844513664265555579356222181",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-edaa9324",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 1306.0,
"function_hash": "320241958175093881091290427079770006414"
},
"id": "ASB-A-366401629-366b753b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293101183722590943478867740640679466749",
"108412991053796078583091860813531505642",
"28035893926855174962940746953580967671",
"40112860432468891969057084409714236080",
"177480183194004016276858230791931740979",
"172276761039711939950469013439173632504",
"101497221201453250963401664882264014271",
"38057727491844513664265555579356222181",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-56658158",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-583296b6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 322.0,
"function_hash": "205161867117239727942345407947753384515"
},
"id": "ASB-A-366401629-d7812ae8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-08136352",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"275136482310096949223314165621352716840",
"8115445310509100908857167739662128042",
"253441721171165215243821755830095971678",
"88776566412728272429447891863167717932",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-21bb3464",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 1377.0,
"function_hash": "338350863036102985394706704282023021029"
},
"id": "ASB-A-366401629-e1812b4e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 379.0,
"function_hash": "249159885145870363150402675264162571837"
},
"id": "ASB-A-366401629-ef63506c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293101183722590943478867740640679466749",
"108412991053796078583091860813531505642",
"28035893926855174962940746953580967671",
"40112860432468891969057084409714236080",
"177480183194004016276858230791931740979",
"172276761039711939950469013439173632504",
"101497221201453250963401664882264014271",
"38057727491844513664265555579356222181",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-14226ff4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-175a338c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 322.0,
"function_hash": "205161867117239727942345407947753384515"
},
"id": "ASB-A-366401629-40363280",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 1306.0,
"function_hash": "320241958175093881091290427079770006414"
},
"id": "ASB-A-366401629-d22a7bdd",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}{
"vanir_signatures": [
{
"digest": {
"length": 1377.0,
"function_hash": "338350863036102985394706704282023021029"
},
"id": "ASB-A-366401629-084c4570",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a",
"target": {
"function": "updatePreferenceIntents",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 379.0,
"function_hash": "249159885145870363150402675264162571837"
},
"id": "ASB-A-366401629-24cbf0d0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a",
"target": {
"function": "onPreferenceClick",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"275136482310096949223314165621352716840",
"8115445310509100908857167739662128042",
"253441721171165215243821755830095971678",
"88776566412728272429447891863167717932",
"291181340016329943787835484543735978002",
"337055358763802024687632734263119858537",
"144527641339476917381900104948976199380",
"288804223690381204920515188312016379424",
"321282692846684833123748020644360983800",
"92202846900541558230823896526142212141",
"142522869818369563026579756524167146678",
"99985113270951985539927909697017026260",
"46167360946225016189541062569585315829",
"21482840765400729961458176275511083467",
"10483233878163130821033715343137177339",
"50912571117168118554999577203142604775"
]
},
"id": "ASB-A-366401629-4372bfae",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a",
"target": {
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
},
{
"digest": {
"length": 539.0,
"function_hash": "39329553774310626754490354329580384782"
},
"id": "ASB-A-366401629-ff19356c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a",
"target": {
"function": "isSafeIntent",
"file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a"
],
"types": [
"EoP"
],
"spl": "2025-02-01",
"severity": "High"
}