In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77677006801428176548926266466550041366",
"302974422285620253543925709362284913912",
"288060709442585844340633621568483622285",
"243438834185482140296435035497265770882",
"131183236054198699741131851713682191126",
"193917236128047840919626409748659197465",
"41442279481687465988310521554831070567"
]
},
"id": "PUB-A-195412179-25f9599e",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/zenaccess/ZenAccessDetails.java"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 254.0,
"function_hash": "320023194517031170527375437891551357031"
},
"id": "PUB-A-195412179-5637378a",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/notificationaccess/NotificationAccessDetails.java",
"function": "setIntentAndFinish"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96896078003893423511230305656805834171",
"204533698518738518464329777290748534398",
"159979403716167700023243167975900515872",
"91728490185144564431620245377121420120",
"126031736227718914080169814886478238962",
"64707774347609129933191993223364853543",
"640951057105632582082164522887529747",
"241449457746286498184484084199513971508",
"32077554720783471249594932723890491866",
"311141140596106732179433000379527904891",
"313464209105001128407745376545374258699",
"129454241990150860728046480313010125998",
"164153366582158055976380227839590881744",
"83160336039881705053626554869413238136",
"264335523321465585587781254520360903540",
"308104919995006952523820368106070055252",
"308018956883914082479587585927070982618",
"129981388302956578162621720284826158104"
]
},
"id": "PUB-A-195412179-56b9f7ee",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/notificationaccess/NotificationAccessDetails.java"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 234.0,
"function_hash": "79456805336176320396763897580974287045"
},
"id": "PUB-A-195412179-79aa2674",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/zenaccess/ZenAccessDetails.java",
"function": "refreshUi"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 896.0,
"function_hash": "120450392376070500879756491848392551899"
},
"id": "PUB-A-195412179-b9723614",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/notificationaccess/NotificationAccessDetails.java",
"function": "retrieveAppEntry"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 990.0,
"function_hash": "257147357623794381761081101812531888082"
},
"id": "PUB-A-195412179-d1afaa19",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59",
"target": {
"file": "src/com/android/settings/applications/specialaccess/notificationaccess/NotificationAccessDetails.java",
"function": "onResume"
}
}
],
"types": [
"ID"
],
"severity": "Moderate",
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/1aff9c726a73c79fb01c9bc35af83f198605bd59"
],
"spl": "2021-12-01"
}