In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"length": 4953.0,
"function_hash": "289724749186343298368526051680267370590"
},
"id": "PUB-A-197327688-9ac659e3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/14be358a42baec86a455eb29f5bfd7b199f1f723",
"target": {
"function": "addSubInfo",
"file": "src/java/com/android/internal/telephony/SubscriptionController.java"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"166883894788935765100559735328696763720",
"191950681679039113004030602475493243212",
"19634598851628924640678288177587335525",
"275010079118535937682695609381801818966",
"52059141820200656844085523289727897936",
"225182137329544760174283786349385752117",
"221478029353754719531396848054004658837",
"169136381970389169926388510551420767203",
"237170297472107590320738408318786194047",
"93920528443875874632570692988165181557",
"279362122725990476828261228767286683029",
"225225310980515726818384730943480324931"
]
},
"id": "PUB-A-197327688-d7c8e589",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/14be358a42baec86a455eb29f5bfd7b199f1f723",
"target": {
"file": "src/java/com/android/internal/telephony/SubscriptionController.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/14be358a42baec86a455eb29f5bfd7b199f1f723"
],
"types": [
"DoS"
],
"spl": "2021-12-01",
"severity": "Moderate"
}