In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "types": [ "EoP" ], "spl": "2021-12-01", "vanir_signatures": [ { "signature_version": "v1", "id": "PUB-A-197749180-3f2dbe3d", "digest": { "function_hash": "334648985680967749890802445307058064647", "length": 1880.0 }, "signature_type": "Function", "target": { "file": "service/java/com/android/server/wifi/WifiServiceImpl.java", "function": "getConfiguredNetworks" }, "deprecated": false, "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c" }, { "signature_version": "v1", "id": "PUB-A-197749180-64544f15", "digest": { "function_hash": "327847369796639015017293184543632006127", "length": 1930.0 }, "signature_type": "Function", "target": { "file": "service/java/com/android/server/wifi/WifiServiceImpl.java", "function": "getConfiguredNetworks" }, "deprecated": false, "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2" }, { "signature_version": "v1", "id": "PUB-A-197749180-8dbf5092", "digest": { "line_hashes": [ "242625264923287647758179166497465093176", "44977527038889901187066130860769944062", "101914245691445740562944914213089121830", "97051022933864093902631334303086124073" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "service/java/com/android/server/wifi/WifiServiceImpl.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c" }, { "signature_version": "v1", "id": "PUB-A-197749180-a61c95ca", "digest": { "line_hashes": [ "302969208553209795699394871896338548177", "333781268783009854615046583021662604320", "225547670772104569077788438763876594552", "195658567196769855873735416827242643507", "53516275232811418909982485714111762473", "252039387123234998459734797382738281411", "243913910916253974464286809172054759936", "304739526116444971162023329891411992156", "225486785194533299999449523517217262572", "264390522332305475465630497058963559990", "186473257942834545907138943477719439251", "337149880851248060870007276554744594887", "145220003403139650679431654571756770122", "318410186178633709574502047328059998172", "178901837964836214470079003488947459267", "209985048356082248825299632260794314658", "307553929703386064941037471466891004284", "314677869122922379937794292893576028583", "260422291903354433595950437439616714709", "160009824145398759223771539058023412881", "163234189747515439179273466715147244297" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "service/java/com/android/server/wifi/WifiServiceImpl.java" }, "deprecated": false, "source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2" } ], "fixes": [ "https://android.googlesource.com/platform/packages/modules/Wifi/+/bd8881739d3a318cad4e2bef60b03547dd14715c", "https://android.googlesource.com/platform/packages/modules/Wifi/+/6e6650c76c25a1d0279ab16b9cd0d63b841906e2" ], "severity": "Moderate" }