In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 1178.0, "function_hash": "334704927292896546458282507381958379927" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishOperationUnchecked" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334", "signature_version": "v1", "id": "ASB-A-416491779-0a5deb8c", "signature_type": "Function" }, { "digest": { "length": 3405.0, "function_hash": "111967766583563337480242246371989750843" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "verifyAndGetBypass" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334", "signature_version": "v1", "id": "ASB-A-416491779-545f70fb", "signature_type": "Function" }, { "digest": { "length": 1055.0, "function_hash": "327351317148874351051936886024995642625" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishProxyOperationImpl" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334", "signature_version": "v1", "id": "ASB-A-416491779-c5ffc71e", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "145533244394736777395731452236992008948", "182579222671641036008456792982496461036", "107591864359346254554150275515285606047", "248772084889652525055504487801912826691", "85681592519442832056565856915305771783", "10741109392020906302907331903711148440", "309900105482878652350026734096691180069", "298003043970286345154228361254524237621", "128046658418123467001747816450010594390", "79745726213375083831113428051279685537", "141827826080887564643400668847525488327", "266080197234080450483255357434435658099", "96473944444397072355208669320627881184", "308632757527921590426640414761795115068", "286423069938739402049272415851038774081", "201093797458725854064338772421567490248", "124054076399324471630608617786007720709", "286085259704673804422033465527098940917", "165450472562439424311051595638473434928", "237422163748034095650877695024740199813", "126896969738788003213948840285398483375", "326671246052218534208019850571232824079", "198385719537384758387429535128527416772", "315952819557544547305654039091072256369", "103285690949153253017694988257707593738", "255582232247872434010096351322051971832", "245750786413319727894170518589327460774", "110484453700089275035591506105064992793", "161108383840385617822320201804815905892", "14647373960907151971344084714157858522", "262754680900253367976251405950549203304", "198872632702529793301821859466264200115", "217525580373318332542580908768624589425", "116256911430510318547601549537866915458", "51155141883239242627593694561320896375", "334256952925092768415641147313273253070", "327146297051040508688237695062253274717", "229881087295695753805407895940465887942", "308030141275839695269238968837200168390", "117987537531020790817837648613375359968", "31197032750000031620870360164106773875", "106668003845575818094709242710479608026", "147388735585732077698752243275182760238", "228085740630932503487399084921443665430", "305746464712692291170662939816387014396", "132340738130790428793573747325850266128", "257196362004999581498472046323076186034", "99258469862926988714611812929941645580", "20202893608044096791124949774349315572", "165229511530923198138663292093310549636", "223348011294678245660878046408810816469", "324900586039617778497669082062963388034", "63187830824006094765050704652296615372" ] }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334", "signature_version": "v1", "id": "ASB-A-416491779-eec3edcd", "signature_type": "Line" } ], "severity": "High", "types": [ "DoS" ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334" ], "spl": "2025-09-01" }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "145533244394736777395731452236992008948", "182579222671641036008456792982496461036", "107591864359346254554150275515285606047", "248772084889652525055504487801912826691", "85681592519442832056565856915305771783", "10741109392020906302907331903711148440", "309900105482878652350026734096691180069", "298003043970286345154228361254524237621", "128046658418123467001747816450010594390", "79745726213375083831113428051279685537", "141827826080887564643400668847525488327", "266080197234080450483255357434435658099", "96473944444397072355208669320627881184", "308632757527921590426640414761795115068", "286423069938739402049272415851038774081", "201093797458725854064338772421567490248", "124054076399324471630608617786007720709", "286085259704673804422033465527098940917", "165450472562439424311051595638473434928", "237422163748034095650877695024740199813", "126896969738788003213948840285398483375", "326671246052218534208019850571232824079", "198385719537384758387429535128527416772", "315952819557544547305654039091072256369", "119021153742612316687371175755315154247", "255582232247872434010096351322051971832", "245750786413319727894170518589327460774", "110484453700089275035591506105064992793", "161108383840385617822320201804815905892", "14647373960907151971344084714157858522", "262754680900253367976251405950549203304", "198872632702529793301821859466264200115", "217525580373318332542580908768624589425", "116256911430510318547601549537866915458", "51155141883239242627593694561320896375", "334256952925092768415641147313273253070", "327146297051040508688237695062253274717", "229881087295695753805407895940465887942", "308030141275839695269238968837200168390", "117987537531020790817837648613375359968", "31197032750000031620870360164106773875", "106668003845575818094709242710479608026", "147388735585732077698752243275182760238", "228085740630932503487399084921443665430", "305746464712692291170662939816387014396", "132340738130790428793573747325850266128", "257196362004999581498472046323076186034", "99258469862926988714611812929941645580", "20202893608044096791124949774349315572", "165229511530923198138663292093310549636", "223348011294678245660878046408810816469", "324900586039617778497669082062963388034", "63187830824006094765050704652296615372" ] }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35", "signature_version": "v1", "id": "ASB-A-416491779-456e5737", "signature_type": "Line" }, { "digest": { "length": 1170.0, "function_hash": "142377889538189004401053715356650317274" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishOperationUnchecked" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35", "signature_version": "v1", "id": "ASB-A-416491779-78fef3ec", "signature_type": "Function" }, { "digest": { "length": 1055.0, "function_hash": "327351317148874351051936886024995642625" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishProxyOperationImpl" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35", "signature_version": "v1", "id": "ASB-A-416491779-d157c220", "signature_type": "Function" }, { "digest": { "length": 3405.0, "function_hash": "111967766583563337480242246371989750843" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "verifyAndGetBypass" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35", "signature_version": "v1", "id": "ASB-A-416491779-f9c2a717", "signature_type": "Function" } ], "severity": "High", "types": [ "DoS" ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35" ], "spl": "2025-09-01" }
{ "vanir_signatures": [ { "digest": { "length": 3405.0, "function_hash": "111967766583563337480242246371989750843" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "verifyAndGetBypass" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8", "signature_version": "v1", "id": "ASB-A-416491779-41f7b3a0", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "145533244394736777395731452236992008948", "182579222671641036008456792982496461036", "107591864359346254554150275515285606047", "248772084889652525055504487801912826691", "85681592519442832056565856915305771783", "10741109392020906302907331903711148440", "309900105482878652350026734096691180069", "298003043970286345154228361254524237621", "128046658418123467001747816450010594390", "79745726213375083831113428051279685537", "141827826080887564643400668847525488327", "266080197234080450483255357434435658099", "96473944444397072355208669320627881184", "308632757527921590426640414761795115068", "286423069938739402049272415851038774081", "201093797458725854064338772421567490248", "124054076399324471630608617786007720709", "286085259704673804422033465527098940917", "165450472562439424311051595638473434928", "237422163748034095650877695024740199813", "126896969738788003213948840285398483375", "326671246052218534208019850571232824079", "198385719537384758387429535128527416772", "315952819557544547305654039091072256369", "103285690949153253017694988257707593738", "255582232247872434010096351322051971832", "245750786413319727894170518589327460774", "110484453700089275035591506105064992793", "161108383840385617822320201804815905892", "14647373960907151971344084714157858522", "262754680900253367976251405950549203304", "198872632702529793301821859466264200115", "217525580373318332542580908768624589425", "116256911430510318547601549537866915458", "51155141883239242627593694561320896375", "334256952925092768415641147313273253070", "327146297051040508688237695062253274717", "229881087295695753805407895940465887942", "308030141275839695269238968837200168390", "117987537531020790817837648613375359968", "31197032750000031620870360164106773875", "106668003845575818094709242710479608026", "147388735585732077698752243275182760238", "228085740630932503487399084921443665430", "305746464712692291170662939816387014396", "132340738130790428793573747325850266128", "257196362004999581498472046323076186034", "99258469862926988714611812929941645580", "20202893608044096791124949774349315572", "165229511530923198138663292093310549636", "223348011294678245660878046408810816469", "324900586039617778497669082062963388034", "63187830824006094765050704652296615372" ] }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8", "signature_version": "v1", "id": "ASB-A-416491779-9631a57e", "signature_type": "Line" }, { "digest": { "length": 1178.0, "function_hash": "334704927292896546458282507381958379927" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishOperationUnchecked" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8", "signature_version": "v1", "id": "ASB-A-416491779-ac6e8904", "signature_type": "Function" }, { "digest": { "length": 1055.0, "function_hash": "327351317148874351051936886024995642625" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishProxyOperationImpl" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8", "signature_version": "v1", "id": "ASB-A-416491779-b1b8f5e9", "signature_type": "Function" } ], "severity": "High", "types": [ "DoS" ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8" ], "spl": "2025-09-01" }
{ "vanir_signatures": [ { "digest": { "length": 3397.0, "function_hash": "47731183929077967472043063613341641217" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "verifyAndGetBypass" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854", "signature_version": "v1", "id": "ASB-A-416491779-1cc04b6f", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "145533244394736777395731452236992008948", "309215926538045402602657564343502449411", "212736499001916873285724335412318095409", "140468702664407564615741072009711414593", "111894624664285355382775798437093391310", "36832147086446174073806500118908194327", "67259588965742049087858546075940583252", "213300930277564897353494739351679481071", "176107377025305689034526358438740090604", "79745726213375083831113428051279685537", "141827826080887564643400668847525488327", "266080197234080450483255357434435658099", "286085259704673804422033465527098940917", "165450472562439424311051595638473434928", "237422163748034095650877695024740199813", "126896969738788003213948840285398483375", "326671246052218534208019850571232824079", "198385719537384758387429535128527416772", "315952819557544547305654039091072256369", "335334773055924698587996816271197000479", "142755240643133366352348226964143927718", "122544624308948724187252201795294179415", "1577266320319389897667113252356691913", "245750786413319727894170518589327460774", "110484453700089275035591506105064992793", "161108383840385617822320201804815905892", "14647373960907151971344084714157858522", "262754680900253367976251405950549203304", "198872632702529793301821859466264200115", "217525580373318332542580908768624589425", "116256911430510318547601549537866915458", "51155141883239242627593694561320896375", "334256952925092768415641147313273253070", "327146297051040508688237695062253274717", "229881087295695753805407895940465887942", "308030141275839695269238968837200168390", "117987537531020790817837648613375359968", "31197032750000031620870360164106773875", "106668003845575818094709242710479608026", "147388735585732077698752243275182760238", "228085740630932503487399084921443665430", "305746464712692291170662939816387014396", "132340738130790428793573747325850266128", "257196362004999581498472046323076186034", "99258469862926988714611812929941645580", "20202893608044096791124949774349315572", "165229511530923198138663292093310549636", "223348011294678245660878046408810816469", "324900586039617778497669082062963388034", "63187830824006094765050704652296615372" ] }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854", "signature_version": "v1", "id": "ASB-A-416491779-266b8c58", "signature_type": "Line" }, { "digest": { "length": 1104.0, "function_hash": "59196600810686604718954192125864229022" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishOperationUnchecked" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854", "signature_version": "v1", "id": "ASB-A-416491779-b13332de", "signature_type": "Function" }, { "digest": { "length": 821.0, "function_hash": "60043437227780985203000308944936520264" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishProxyOperationImpl" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854", "signature_version": "v1", "id": "ASB-A-416491779-ccedb493", "signature_type": "Function" } ], "severity": "High", "types": [ "DoS" ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854" ], "spl": "2025-09-01" }
{ "vanir_signatures": [ { "digest": { "length": 3405.0, "function_hash": "111967766583563337480242246371989750843" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "verifyAndGetBypass" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f", "signature_version": "v1", "id": "ASB-A-416491779-59ada09a", "signature_type": "Function" }, { "digest": { "length": 1224.0, "function_hash": "302778091020712272410206182193732067432" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishOperationUnchecked" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f", "signature_version": "v1", "id": "ASB-A-416491779-7b2236ca", "signature_type": "Function" }, { "digest": { "length": 849.0, "function_hash": "88862171116627248423609488485975155833" }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java", "function": "finishProxyOperationImpl" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f", "signature_version": "v1", "id": "ASB-A-416491779-c9ec0153", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "145533244394736777395731452236992008948", "309215926538045402602657564343502449411", "212736499001916873285724335412318095409", "140468702664407564615741072009711414593", "111894624664285355382775798437093391310", "36832147086446174073806500118908194327", "67259588965742049087858546075940583252", "213300930277564897353494739351679481071", "176107377025305689034526358438740090604", "79745726213375083831113428051279685537", "141827826080887564643400668847525488327", "266080197234080450483255357434435658099", "96473944444397072355208669320627881184", "198170298809086924941692793639245543997", "67862067983392615665773527569907833010", "258090797395468389451732751057449770439", "225956139237626615904419152772393606133", "286085259704673804422033465527098940917", "165450472562439424311051595638473434928", "237422163748034095650877695024740199813", "126896969738788003213948840285398483375", "326671246052218534208019850571232824079", "198385719537384758387429535128527416772", "315952819557544547305654039091072256369", "335334773055924698587996816271197000479", "142755240643133366352348226964143927718", "122544624308948724187252201795294179415", "1577266320319389897667113252356691913", "245750786413319727894170518589327460774", "110484453700089275035591506105064992793", "161108383840385617822320201804815905892", "14647373960907151971344084714157858522", "262754680900253367976251405950549203304", "198872632702529793301821859466264200115", "217525580373318332542580908768624589425", "116256911430510318547601549537866915458", "51155141883239242627593694561320896375", "334256952925092768415641147313273253070", "327146297051040508688237695062253274717", "229881087295695753805407895940465887942", "308030141275839695269238968837200168390", "117987537531020790817837648613375359968", "31197032750000031620870360164106773875", "106668003845575818094709242710479608026", "147388735585732077698752243275182760238", "228085740630932503487399084921443665430", "305746464712692291170662939816387014396", "132340738130790428793573747325850266128", "257196362004999581498472046323076186034", "99258469862926988714611812929941645580", "20202893608044096791124949774349315572", "165229511530923198138663292093310549636", "223348011294678245660878046408810816469", "324900586039617778497669082062963388034", "63187830824006094765050704652296615372" ] }, "target": { "file": "services/core/java/com/android/server/appop/AppOpsService.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f", "signature_version": "v1", "id": "ASB-A-416491779-facd8154", "signature_type": "Line" } ], "severity": "High", "types": [ "DoS" ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f" ], "spl": "2025-09-01" }