In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "216061306196585981300064809507201569928",
"length": 4163
},
"id": "ASB-A-517376998-8b8254f7",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "findAndRestoreAllMatches"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-c91b9ade",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"53936002122569484815290621246871179949",
"70576509121161960376188339518662761061",
"297428313761486677327718079304819386556",
"118794406390172136314128945416235955464",
"300584787152345170242481932407377887275",
"91000279944401502212300301446449121768",
"314946229393751904642575607985901090074",
"48071387772265113611768738447220227872",
"230892233880439695298943081283800815836",
"91046966655524689967478206889217130047",
"284773454721187922326320860369632290220",
"267054189197332168947210187875360688486",
"271893851611037262668931233880873809199",
"210369113040066875555737840015415699291",
"298074511415231411534212404752852116128",
"25703267387421632776396060978389066432",
"273044155702715912844332262120968811210",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-d3d45b53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"240433238494184810143839656530126187511",
"8427543793721969093118965675091271151",
"17910702747122044722567336726290983731",
"129282611143923013123369356572484533716",
"211450648062654852176228427153150408841",
"123458277809245106179093615932180321350",
"340115021886211851926004528943838715928",
"31223123999661288800207941957039316100",
"98068253949951945928588739056383828019",
"4138818049494596484870303350329687508",
"61199313712577237046067941375398079003",
"125124786717500389013768378564162325021",
"168692056166021226967507375135811790917",
"24510490044451189075102797641655409022",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-047677bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133759318633514576147821054749434568423",
"length": 607
},
"id": "ASB-A-517376998-3e44e3d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionForApnTable"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-45263833",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178943418797874659006337080546758787415",
"254426424400320467474497305036242758145",
"83974394610340653447941319089408175950",
"319796118768737917365418783325404363194",
"264288317705191403379031113407962083954",
"337451599964745881534083711978499529968",
"321779854046422385171112623528674007525",
"71784267710571752780925340652729611155",
"49862630043043235314643615992343296383",
"250554287766018351313053081232812084538"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-533f5bb3",
"match_only_versions": [
"15"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519",
"target": {
"file": "tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222110957754234632793106596897145323606",
"length": 324
},
"id": "ASB-A-517376998-ecf34087",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionCompat"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"178943418797874659006337080546758787415",
"254426424400320467474497305036242758145",
"83974394610340653447941319089408175950",
"319796118768737917365418783325404363194",
"264288317705191403379031113407962083954",
"337451599964745881534083711978499529968",
"321779854046422385171112623528674007525",
"71784267710571752780925340652729611155",
"49862630043043235314643615992343296383",
"250554287766018351313053081232812084538"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-27accb24",
"match_only_versions": [
"16"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3",
"target": {
"file": "tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-4e522157",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222110957754234632793106596897145323606",
"length": 324
},
"id": "ASB-A-517376998-9fedb150",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionCompat"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45238555306102366473307333753867188196",
"length": 716
},
"id": "ASB-A-517376998-a1d14232",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionForApnTable"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240433238494184810143839656530126187511",
"8427543793721969093118965675091271151",
"17910702747122044722567336726290983731",
"129282611143923013123369356572484533716",
"145449402105482051351096302505063513080",
"229525023229349362386399826596819554960",
"59551926140787356963347667253666440099",
"31223123999661288800207941957039316100",
"98068253949951945928588739056383828019",
"4138818049494596484870303350329687508",
"61199313712577237046067941375398079003",
"125124786717500389013768378564162325021",
"168692056166021226967507375135811790917",
"24510490044451189075102797641655409022",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-f3b0651b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"240433238494184810143839656530126187511",
"8427543793721969093118965675091271151",
"17910702747122044722567336726290983731",
"129282611143923013123369356572484533716",
"226197694517301515154906915255327386937",
"286612548340133698947489893572453287830",
"215763414543607856149625014482400368364",
"31223123999661288800207941957039316100",
"98068253949951945928588739056383828019",
"4138818049494596484870303350329687508",
"61199313712577237046067941375398079003",
"125124786717500389013768378564162325021",
"168692056166021226967507375135811790917",
"24510490044451189075102797641655409022",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-8324c6ba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178943418797874659006337080546758787415",
"254426424400320467474497305036242758145",
"83974394610340653447941319089408175950",
"319796118768737917365418783325404363194",
"264288317705191403379031113407962083954",
"337451599964745881534083711978499529968",
"321779854046422385171112623528674007525",
"71784267710571752780925340652729611155",
"49862630043043235314643615992343296383",
"250554287766018351313053081232812084538"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-a898b5fe",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1",
"target": {
"file": "tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222110957754234632793106596897145323606",
"length": 324
},
"id": "ASB-A-517376998-cd18a52b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionCompat"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71762686510462485380730577436550643817",
"length": 684
},
"id": "ASB-A-517376998-ce567c5d",
"match_only_versions": [
"16-qpr2"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionForApnTable"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-dc7c3037",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "222110957754234632793106596897145323606",
"length": 324
},
"id": "ASB-A-517376998-297f1d45",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionCompat"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240433238494184810143839656530126187511",
"8427543793721969093118965675091271151",
"17910702747122044722567336726290983731",
"129282611143923013123369356572484533716",
"226197694517301515154906915255327386937",
"286612548340133698947489893572453287830",
"215763414543607856149625014482400368364",
"31223123999661288800207941957039316100",
"98068253949951945928588739056383828019",
"4138818049494596484870303350329687508",
"61199313712577237046067941375398079003",
"125124786717500389013768378564162325021",
"168692056166021226967507375135811790917",
"24510490044451189075102797641655409022",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-687f2145",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178943418797874659006337080546758787415",
"254426424400320467474497305036242758145",
"83974394610340653447941319089408175950",
"319796118768737917365418783325404363194",
"264288317705191403379031113407962083954",
"337451599964745881534083711978499529968",
"321779854046422385171112623528674007525",
"71784267710571752780925340652729611155",
"49862630043043235314643615992343296383",
"250554287766018351313053081232812084538"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-74827288",
"match_only_versions": [
"17"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8",
"target": {
"file": "tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-9aa0e0d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71762686510462485380730577436550643817",
"length": 684
},
"id": "ASB-A-517376998-b5e9ecd2",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionForApnTable"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"178943418797874659006337080546758787415",
"254426424400320467474497305036242758145",
"83974394610340653447941319089408175950",
"319796118768737917365418783325404363194",
"264288317705191403379031113407962083954",
"337451599964745881534083711978499529968",
"321779854046422385171112623528674007525",
"71784267710571752780925340652729611155",
"49862630043043235314643615992343296383",
"250554287766018351313053081232812084538"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-0279e6d6",
"match_only_versions": [
"14"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc",
"target": {
"file": "tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "7976586926259062484835703724006128362",
"length": 458
},
"id": "ASB-A-517376998-0f05876c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkQueryPermission"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133759318633514576147821054749434568423",
"length": 607
},
"id": "ASB-A-517376998-26364dc5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionForApnTable"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222110957754234632793106596897145323606",
"length": 324
},
"id": "ASB-A-517376998-45179a2a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java",
"function": "checkPermissionCompat"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240433238494184810143839656530126187511",
"8427543793721969093118965675091271151",
"17910702747122044722567336726290983731",
"129282611143923013123369356572484533716",
"211450648062654852176228427153150408841",
"123458277809245106179093615932180321350",
"340115021886211851926004528943838715928",
"31223123999661288800207941957039316100",
"98068253949951945928588739056383828019",
"4138818049494596484870303350329687508",
"61199313712577237046067941375398079003",
"125124786717500389013768378564162325021",
"168692056166021226967507375135811790917",
"24510490044451189075102797641655409022",
"45144815370482708907229697490453851924",
"91733330381032293994465764465049641403",
"41093927655112614800845340185873384104",
"230978211482868517648612192544250696848"
],
"threshold": 0.9
},
"id": "ASB-A-517376998-cbc95869",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc",
"target": {
"file": "src/com/android/providers/telephony/TelephonyProvider.java"
}
}
]
}