In isBackupServiceActive of BackupManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"id": "PUB-A-158482162-11c121f6",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126914617069042521820672816393767860066",
"318386150061405345264927717734983532266",
"221728323694342322381064209468492865777",
"112943111953274123551621343949152797386"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/d8b61b515938cecd441fae16fc001f1e49274780",
"target": {
"file": "services/backup/java/com/android/server/backup/BackupManagerService.java"
}
},
{
"id": "PUB-A-158482162-33cff289",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 350.0,
"function_hash": "28817180968437617041860775752541731053"
},
"target": {
"function": "isBackupServiceActive",
"file": "core/java/android/app/backup/BackupManager.java"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/4ab5af1eb569a46f2117377382aac7dc6535cfc5"
},
{
"id": "PUB-A-158482162-3996969e",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 114.0,
"function_hash": "338860830296859549198734532255695803967"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/4ab5af1eb569a46f2117377382aac7dc6535cfc5",
"target": {
"function": "isBackupServiceActive",
"file": "services/backup/java/com/android/server/backup/BackupManagerService.java"
}
},
{
"id": "PUB-A-158482162-626a754f",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"24087718340648124539292189666993493388",
"43370372746142269335609137148714937238",
"334667390983267080210022985803336705149",
"238261442841438993754622866140726238788",
"17191668199990111124295222417548341558"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/4ab5af1eb569a46f2117377382aac7dc6535cfc5",
"target": {
"file": "core/java/android/app/backup/BackupManager.java"
}
},
{
"id": "PUB-A-158482162-7ffd5267",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"129895746813861046181917920049257664463",
"117620298669776704389805713989523918166",
"283586711839239482777439284503407201871",
"164910021130588734494249686894885703464",
"65078549187741724161603753187504472296",
"249312252837183729319575848739574603160",
"313324435522662445255318702827351870872",
"256749483367281802150299088835450164742",
"160656964486706790584917490903576418863",
"63058566019477163812682084827178406715",
"295747577431459138783214723720080232905",
"213631008609850099682204767038990613018"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/d8b61b515938cecd441fae16fc001f1e49274780",
"target": {
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"id": "PUB-A-158482162-8c2462b3",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 207.0,
"function_hash": "205926663407531025753952048631687058022"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/b50cdde5f009ca1e8a548605c8b364d860110b67",
"target": {
"function": "isBackupServiceActive",
"file": "services/backup/java/com/android/server/backup/BackupManagerService.java"
}
},
{
"id": "PUB-A-158482162-9a8a5aa8",
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 377.0,
"function_hash": "56334759618532062229800836102525878586"
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/d8b61b515938cecd441fae16fc001f1e49274780",
"target": {
"function": "isBackupServiceEnabled",
"file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
}
},
{
"id": "PUB-A-158482162-a903da33",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"186080164564326707490355719243218777986",
"118150971760448194955935622080642738111",
"247670790405913324122141452034430768173",
"336380332919789045212109529589618755828",
"198173940083429911575214721846122336185",
"169054735968885439558149362866903830172",
"25299089395159407179068800657743919348",
"315726064545806713831328197111936543989",
"327949731336209550509669467922401020933"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/b50cdde5f009ca1e8a548605c8b364d860110b67",
"target": {
"file": "services/backup/java/com/android/server/backup/BackupManagerService.java"
}
},
{
"id": "PUB-A-158482162-b5624ab9",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"329065042415119750146087076341786792847",
"251388435269381718613865477082283272058",
"6730393615937548007520985769699600955",
"40146263960495807444905174138469593667"
]
},
"source": "https://android.googlesource.com/platform/frameworks/base/+/4ab5af1eb569a46f2117377382aac7dc6535cfc5",
"target": {
"file": "services/backup/java/com/android/server/backup/BackupManagerService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/b50cdde5f009ca1e8a548605c8b364d860110b67",
"https://android.googlesource.com/platform/frameworks/base/+/4ab5af1eb569a46f2117377382aac7dc6535cfc5",
"https://android.googlesource.com/platform/frameworks/base/+/d8b61b515938cecd441fae16fc001f1e49274780"
],
"severity": "Moderate",
"spl": "2021-06-01",
"types": [
"ID"
]
}