In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
{
"types": [
"ID"
],
"spl": "2021-12-01",
"severity": "Moderate",
"vanir_signatures": [
{
"id": "PUB-A-195963373-72c0e0cf",
"target": {
"function": "onCreate",
"file": "src/com/android/settings/fuelgauge/RequestIgnoreBatteryOptimizations.java"
},
"digest": {
"length": 1699.0,
"function_hash": "69012629016051045894804546584320277806"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/55890075300bcd60ab1accee302d2a20aa71c8a8",
"signature_type": "Function"
},
{
"id": "PUB-A-195963373-d07daac2",
"target": {
"function": "onClick",
"file": "src/com/android/settings/fuelgauge/RequestIgnoreBatteryOptimizations.java"
},
"digest": {
"length": 209.0,
"function_hash": "222629958470458075846120450748326754006"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/55890075300bcd60ab1accee302d2a20aa71c8a8",
"signature_type": "Function"
},
{
"id": "PUB-A-195963373-dc7691c7",
"target": {
"file": "src/com/android/settings/fuelgauge/RequestIgnoreBatteryOptimizations.java"
},
"digest": {
"line_hashes": [
"200774990146046719467992812428675744624",
"314009089417719576841736974480070405096",
"42723053773459545878633655501729225405",
"12155965660268937498061129424570913441",
"163324181676046738502552769937319696291",
"18989106369490027360788858788468418641",
"119344837202380686854663212682070541591",
"54747317895483004128483675118253212910",
"86119090561978380685113609866550758595",
"25945894192421614444586621121786039312",
"268942282613060029538542700024590498614",
"126504596524473447990425157471530701169",
"320718835992693066271387003750475290036",
"293391267082056322480823382484213394410",
"102815327562871578043348869596814111040",
"210749027793198945999481307600819994936",
"25945894192421614444586621121786039312",
"145051783284445340545287674609561019598",
"67944642808064235305020962901184337283",
"323137476376376193230907639715448314763",
"24152281854763850584055429747866504017",
"121361017228918539868745939004873699850",
"101883991190114596528205643766023063486",
"27644540798050933262865428636265818218",
"21767907860342981132611308476675691062",
"94009025544309408268089598280165160099",
"37037712461241614714516175276461173870",
"25354350726695397340385012127078095812",
"25200031284962401947172900165970798811",
"324270581132171560385751091483322424982",
"201120659892805285379485969999274594327",
"1436973857580476486511812464297846289",
"281058423643137999078217362385188550540",
"112686005132637378188609075720412288930",
"161443092250633024725586362524942221039",
"75407180318704451699303769443305508093"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/55890075300bcd60ab1accee302d2a20aa71c8a8",
"signature_type": "Line"
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/55890075300bcd60ab1accee302d2a20aa71c8a8"
]
}