In recycle of Parcel.java, there is a possible way to start foreground activity from background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "types": [ "EoP" ], "severity": "Moderate", "spl": "2022-06-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/011dda6e011aaba1112932576ae4080e10200d7c" ], "vanir_signatures": [ { "id": "PUB-A-208279300-7b603131", "source": "https://android.googlesource.com/platform/frameworks/base/+/011dda6e011aaba1112932576ae4080e10200d7c", "digest": { "length": 407.0, "function_hash": "295972483992823207807516585320029458283" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "function": "recycle", "file": "core/java/android/os/Parcel.java" } }, { "id": "PUB-A-208279300-aca52d55", "source": "https://android.googlesource.com/platform/frameworks/base/+/011dda6e011aaba1112932576ae4080e10200d7c", "digest": { "threshold": 0.9, "line_hashes": [ "316753909301305578740771338963451125640", "86906117398184293737935705669161310446", "289190745808397464931819942032085311598", "134496265879813177300596224622561904500" ] }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/os/Parcel.java" } } ] }
{ "types": [ "EoP" ], "severity": "Moderate", "spl": "2022-06-01", "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/46770fa49c9a5e51a5ea5a3afc7aab0dba2e59bd" ], "vanir_signatures": [ { "id": "PUB-A-208279300-3833ed4d", "source": "https://android.googlesource.com/platform/frameworks/base/+/46770fa49c9a5e51a5ea5a3afc7aab0dba2e59bd", "digest": { "threshold": 0.9, "line_hashes": [ "271829008703992931818398218078023132919", "86906117398184293737935705669161310446", "289190745808397464931819942032085311598", "134496265879813177300596224622561904500" ] }, "signature_type": "Line", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/android/os/Parcel.java" } }, { "id": "PUB-A-208279300-78d30772", "source": "https://android.googlesource.com/platform/frameworks/base/+/46770fa49c9a5e51a5ea5a3afc7aab0dba2e59bd", "digest": { "length": 407.0, "function_hash": "295972483992823207807516585320029458283" }, "signature_type": "Function", "deprecated": false, "signature_version": "v1", "target": { "function": "recycle", "file": "core/java/android/os/Parcel.java" } } ] }