In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
{
"severity": "Moderate",
"spl": "2023-06-01",
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5"
],
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"259590963378098019506138773829549726153",
"339731208879213533049567795100393404370",
"196842569068323951505900298715565166870",
"329733562905097744143027745382026588143",
"205720209166383107665338544471551891192",
"252592248164189551111874193086298457144",
"11183545669860951576976821910399386373",
"146128305057215544987682115085342880259",
"313500056888642801637444288999960462611",
"193185042778935079970618334693391798638",
"94083546051730497024410521945825167427",
"153427308011463891186300293872838534710",
"36838674328849096973044875888633244617",
"190408238883794878463308171751115756505",
"271613605246077307531870517792878558420",
"30164921329345463907376268405083112938",
"312357646526305047107130809857572748499",
"278809718551186143364820167822115175274",
"210970647024931410295177236523325314805",
"318301413169897740538445308134677301705"
]
},
"deprecated": false,
"id": "PUB-A-213942596-12ae4e14",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java"
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13-next"
]
},
{
"digest": {
"length": 580.0,
"function_hash": "191887681608595310044475575209842618885"
},
"deprecated": false,
"id": "PUB-A-213942596-4d2c3de6",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java",
"function": "startLockTaskMode"
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13-next"
]
},
{
"digest": {
"length": 717.0,
"function_hash": "55480523965645955638706682677571455470"
},
"deprecated": false,
"id": "PUB-A-213942596-cda4de2f",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java",
"function": "stopLockTaskMode"
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13-next"
]
}
]
}
{
"severity": "Moderate",
"spl": "2023-06-01",
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5"
],
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"259590963378098019506138773829549726153",
"339731208879213533049567795100393404370",
"196842569068323951505900298715565166870",
"329733562905097744143027745382026588143",
"205720209166383107665338544471551891192",
"252592248164189551111874193086298457144",
"11183545669860951576976821910399386373",
"146128305057215544987682115085342880259",
"313500056888642801637444288999960462611",
"193185042778935079970618334693391798638",
"94083546051730497024410521945825167427",
"153427308011463891186300293872838534710",
"36838674328849096973044875888633244617",
"190408238883794878463308171751115756505",
"271613605246077307531870517792878558420",
"30164921329345463907376268405083112938",
"312357646526305047107130809857572748499",
"278809718551186143364820167822115175274",
"210970647024931410295177236523325314805",
"318301413169897740538445308134677301705"
]
},
"deprecated": false,
"id": "PUB-A-213942596-22c0fc64",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java"
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13"
]
},
{
"digest": {
"length": 717.0,
"function_hash": "55480523965645955638706682677571455470"
},
"deprecated": false,
"id": "PUB-A-213942596-a4a3fbbc",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java",
"function": "stopLockTaskMode"
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13"
]
},
{
"digest": {
"length": 580.0,
"function_hash": "191887681608595310044475575209842618885"
},
"deprecated": false,
"id": "PUB-A-213942596-e0328ab3",
"target": {
"file": "services/core/java/com/android/server/wm/LockTaskController.java",
"function": "startLockTaskMode"
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/base/+/540a7c32d856f9513ea26ffc4c2b9327f5a3a1b5",
"signature_version": "v1",
"match_only_versions": [
"13"
]
}
]
}