In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"spl": "2021-12-01",
"severity": "Moderate",
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c",
"https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2"
],
"vanir_signatures": [
{
"deprecated": false,
"id": "PUB-A-197749180-3f2dbe3d",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c",
"signature_version": "v1",
"target": {
"function": "getConfiguredNetworks",
"file": "service/java/com/android/server/wifi/WifiServiceImpl.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "334648985680967749890802445307058064647",
"length": 1880.0
}
},
{
"deprecated": false,
"id": "PUB-A-197749180-64544f15",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2",
"signature_version": "v1",
"target": {
"function": "getConfiguredNetworks",
"file": "service/java/com/android/server/wifi/WifiServiceImpl.java"
},
"signature_type": "Function",
"digest": {
"function_hash": "327847369796639015017293184543632006127",
"length": 1930.0
}
},
{
"deprecated": false,
"id": "PUB-A-197749180-8dbf5092",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c",
"signature_version": "v1",
"target": {
"file": "service/java/com/android/server/wifi/WifiServiceImpl.java"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242625264923287647758179166497465093176",
"44977527038889901187066130860769944062",
"101914245691445740562944914213089121830",
"97051022933864093902631334303086124073"
]
}
},
{
"deprecated": false,
"id": "PUB-A-197749180-a61c95ca",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2",
"signature_version": "v1",
"target": {
"file": "service/java/com/android/server/wifi/WifiServiceImpl.java"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302969208553209795699394871896338548177",
"333781268783009854615046583021662604320",
"225547670772104569077788438763876594552",
"195658567196769855873735416827242643507",
"53516275232811418909982485714111762473",
"252039387123234998459734797382738281411",
"243913910916253974464286809172054759936",
"304739526116444971162023329891411992156",
"225486785194533299999449523517217262572",
"264390522332305475465630497058963559990",
"186473257942834545907138943477719439251",
"337149880851248060870007276554744594887",
"145220003403139650679431654571756770122",
"318410186178633709574502047328059998172",
"178901837964836214470079003488947459267",
"209985048356082248825299632260794314658",
"307553929703386064941037471466891004284",
"314677869122922379937794292893576028583",
"260422291903354433595950437439616714709",
"160009824145398759223771539058023412881",
"163234189747515439179273466715147244297"
]
}
}
],
"types": [
"EoP"
]
}