In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"ID"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/c7de46c8e45b0a81da65bb63220f1e502cf04921"
],
"spl": "2021-12-01",
"vanir_signatures": [
{
"id": "PUB-A-193800652-c69b02ce",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/c7de46c8e45b0a81da65bb63220f1e502cf04921",
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"39275217561838728963992075719630011395",
"60949154431976449709105693195531616887",
"261464316904973385258147136598452934597",
"227214050609644533085085003222725773304",
"175625025981031983434455603619840749403",
"98874412179968923432749838123742731022",
"181300433046089138343853969056757871617",
"238714527340987671693651969324152567441",
"107399261705791472036583292945930006355"
]
}
},
{
"id": "PUB-A-193800652-e10ef509",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/c7de46c8e45b0a81da65bb63220f1e502cf04921",
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "hasNamedWallpaper",
"file": "services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"
},
"digest": {
"function_hash": "260323520536712876715714027822045432317",
"length": 562.0
}
}
],
"severity": "Moderate"
}