ASB-A-429182079

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-429182079.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-429182079
Aliases
  • A-429182079
  • CVE-2026-58989
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:16Z
Summary
[none]
Details

In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "58843641692405561116398763900677247296",
                "length":  449
            },
            "id":  "ASB-A-429182079-36eda020",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java",
                "function":  "setOemUnlockAllowedByUser"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "297880842625060905357954905455168146174",
                    "285120567615989224675124832964427182566",
                    "91685311659762911917634782691467810352",
                    "192013408033404563843155183221445358080",
                    "213120363208340397231019579145972232811",
                    "231922727167027481508735651943634885495",
                    "182128733511723708083733918752711026701",
                    "107571502601989328817999047580204506339",
                    "203776309777225035639472435724568064982",
                    "127522153821616804758509570245604115407",
                    "272694874155991502934684844614796278555"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-429182079-7c253119",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-429182079.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "297880842625060905357954905455168146174",
                    "285120567615989224675124832964427182566",
                    "91685311659762911917634782691467810352",
                    "192013408033404563843155183221445358080",
                    "213120363208340397231019579145972232811",
                    "231922727167027481508735651943634885495",
                    "182128733511723708083733918752711026701",
                    "107571502601989328817999047580204506339",
                    "203776309777225035639472435724568064982",
                    "127522153821616804758509570245604115407",
                    "272694874155991502934684844614796278555"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-429182079-331633b5",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "58843641692405561116398763900677247296",
                "length":  449
            },
            "id":  "ASB-A-429182079-34470af6",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java",
                "function":  "setOemUnlockAllowedByUser"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-429182079.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "58843641692405561116398763900677247296",
                "length":  449
            },
            "id":  "ASB-A-429182079-43835300",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java",
                "function":  "setOemUnlockAllowedByUser"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "297880842625060905357954905455168146174",
                    "285120567615989224675124832964427182566",
                    "91685311659762911917634782691467810352",
                    "192013408033404563843155183221445358080",
                    "213120363208340397231019579145972232811",
                    "231922727167027481508735651943634885495",
                    "182128733511723708083733918752711026701",
                    "107571502601989328817999047580204506339",
                    "203776309777225035639472435724568064982",
                    "127522153821616804758509570245604115407",
                    "272694874155991502934684844614796278555"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-429182079-67362ff2",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-429182079.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "297880842625060905357954905455168146174",
                    "285120567615989224675124832964427182566",
                    "91685311659762911917634782691467810352",
                    "192013408033404563843155183221445358080",
                    "213120363208340397231019579145972232811",
                    "231922727167027481508735651943634885495",
                    "182128733511723708083733918752711026701",
                    "107571502601989328817999047580204506339",
                    "203776309777225035639472435724568064982",
                    "127522153821616804758509570245604115407",
                    "272694874155991502934684844614796278555"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-429182079-f9b99880",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "58843641692405561116398763900677247296",
                "length":  449
            },
            "id":  "ASB-A-429182079-fd6cd928",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8",
            "target":  {
                "file":  "services/core/java/com/android/server/oemlock/OemLockService.java",
                "function":  "setOemUnlockAllowedByUser"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-429182079.json"