In archiveStoredConversation of MmsService.java, there is a possible way to archive message conversation without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"293613250987942263816303288157563540503",
"287124660630697584375849318651089324823",
"36946460191783365413945840267393125669",
"274447771839312378753502653407167139317",
"129291971431529604219013176637066015518",
"240949878323705658310411750882175041252",
"70801864732567594003963611904526830257",
"325710945528148596877556527566916886115"
]
},
"id": "PUB-A-180419673-bcfc8c04",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/services/Mms/+/fc9b30346633e275faa7b44734c1718280407d5f",
"target": {
"file": "src/com/android/mms/service/MmsService.java"
}
},
{
"digest": {
"length": 308.0,
"function_hash": "83129940140774098393147415840015853450"
},
"id": "PUB-A-180419673-eeb9a025",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/services/Mms/+/fc9b30346633e275faa7b44734c1718280407d5f",
"target": {
"function": "archiveStoredConversation",
"file": "src/com/android/mms/service/MmsService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/services/Mms/+/fc9b30346633e275faa7b44734c1718280407d5f"
],
"types": [
"EoP"
],
"spl": "2021-06-01",
"severity": "Moderate"
}