In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"ID"
],
"spl": "2021-12-01",
"vanir_signatures": [
{
"signature_type": "Function",
"digest": {
"function_hash": "176299923158320291701573344948621458305",
"length": 6379.0
},
"target": {
"file": "services/core/java/com/android/server/audio/AudioService.java",
"function": "adjustStreamVolume"
},
"signature_version": "v1",
"id": "PUB-A-194110891-a98b15c9",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "8998870373589591945760064968154984381",
"length": 582.0
},
"target": {
"file": "services/core/java/com/android/server/audio/AudioService.java",
"function": "setMasterMuteInternal"
},
"signature_version": "v1",
"id": "PUB-A-194110891-ac065456",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "80377643262097670515923986644784777856",
"length": 1294.0
},
"target": {
"file": "services/core/java/com/android/server/audio/AudioService.java",
"function": "setMicrophoneMute"
},
"signature_version": "v1",
"id": "PUB-A-194110891-b37e301d",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"26303307386259456102878093547598034270",
"39909750479319076048352011673297363665",
"246710042020951576693437696463063823092",
"210059350988397064971629111864930865360",
"323133313727201563239761714970520034436",
"26303307386259456102878093547598034270",
"39909750479319076048352011673297363665",
"246710042020951576693437696463063823092",
"210059350988397064971629111864930865360",
"223895527631591024693612460265897984928",
"296078150504287092146113664257371987421",
"299975494269098223315030355060322301289",
"119566540634061019133494095644443788163",
"54799143336101955294344102105221450065",
"54557346551133732981596346233777889451",
"40561049783822652696236944529634900595",
"259172265438750111050414924431328394194",
"268327649275314793778237768996646252658",
"161988046539609258551856995847510467348",
"86793386869707102298119512323614161289",
"136555278654703758739428864167688429252",
"33731051288125487793411516196039454450"
]
},
"target": {
"file": "services/core/java/com/android/server/audio/AudioService.java"
},
"signature_version": "v1",
"id": "PUB-A-194110891-cb9a304f",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "12223587273963204284340020412202444960",
"length": 2691.0
},
"target": {
"file": "services/core/java/com/android/server/audio/AudioService.java",
"function": "setStreamVolume"
},
"signature_version": "v1",
"id": "PUB-A-194110891-ec17542d",
"deprecated": false,
"source": "https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/414644a2f7b56160dfc37ae823d70dec98d95796"
],
"severity": "Moderate"
}