In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 6379.0, "function_hash": "176299923158320291701573344948621458305" }, "id": "PUB-A-194110891-a98b15c9", "source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/audio/AudioService.java", "function": "adjustStreamVolume" }, "signature_type": "Function" }, { "digest": { "length": 582.0, "function_hash": "8998870373589591945760064968154984381" }, "id": "PUB-A-194110891-ac065456", "source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/audio/AudioService.java", "function": "setMasterMuteInternal" }, "signature_type": "Function" }, { "digest": { "length": 1294.0, "function_hash": "80377643262097670515923986644784777856" }, "id": "PUB-A-194110891-b37e301d", "source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/audio/AudioService.java", "function": "setMicrophoneMute" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "26303307386259456102878093547598034270", "39909750479319076048352011673297363665", "246710042020951576693437696463063823092", "210059350988397064971629111864930865360", "323133313727201563239761714970520034436", "26303307386259456102878093547598034270", "39909750479319076048352011673297363665", "246710042020951576693437696463063823092", "210059350988397064971629111864930865360", "223895527631591024693612460265897984928", "296078150504287092146113664257371987421", "299975494269098223315030355060322301289", "119566540634061019133494095644443788163", "54799143336101955294344102105221450065", "54557346551133732981596346233777889451", "40561049783822652696236944529634900595", "259172265438750111050414924431328394194", "268327649275314793778237768996646252658", "161988046539609258551856995847510467348", "86793386869707102298119512323614161289", "136555278654703758739428864167688429252", "33731051288125487793411516196039454450" ] }, "id": "PUB-A-194110891-cb9a304f", "source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/audio/AudioService.java" }, "signature_type": "Line" }, { "digest": { "length": 2691.0, "function_hash": "12223587273963204284340020412202444960" }, "id": "PUB-A-194110891-ec17542d", "source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/audio/AudioService.java", "function": "setStreamVolume" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796" ], "spl": "2021-12-01", "severity": "Moderate", "types": [ "ID" ] }