In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6"
],
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"line_hashes": [
"225414579649605086455164722421162307302",
"131843167589712077182869453982091695885",
"41146358113827926209802610559690906425",
"113144014637343550943698699464174034100",
"229040662024954546549080378248385891991",
"277589323322226848925875594293187961979",
"301176694504235049674162607247523667851",
"162081451146598361249488198923263826431",
"250219914779607091147067503934482692255",
"275553038975064260701803419522188188413",
"143593493291452922896643286851082586730",
"92620931920188987448388625012050025585",
"272125282952489436715133741092103825205",
"65290569835726756849466653380210533185",
"174617142230180669202214785275978139631",
"120905939317836215296337974366525576516",
"205809420832521026754714772647735938213",
"93573474251186834212554902374685163920",
"164970509393770215586613522435275589623",
"242365137370603393983607456757686672309",
"103651766630464745028584576654945122646",
"24285093463545498793924451577915205597",
"241011846229631388978144596177466021160",
"155636686849361523618316441483005591103",
"167393488789270758706175914470413385331",
"215802417625677851082933900692599588865",
"124814265051825835933000400054050069797",
"88330933154984939597278803590994284074",
"64409418367845188406721737288988180984",
"304454958106148854925360609511334015826",
"146732679707218223580798012103954042172",
"160939811162922440137381714988878057443",
"15090216309512198211764913722612303713",
"58347513524034841545911476857963889174",
"104105174624008596984946894626473677918",
"189410372937171033404127294772389161969",
"124337164737968615162218777642052250404",
"5103859612240516335527838995952660826",
"316237075165393034389251633038481668782",
"114706332039173501028380245029470872103",
"153350099859066282052524363308739847093",
"32378167859023620498914435719671531058",
"291239079340466811969145164664735890140",
"315308523171101904126497635010654710443",
"203670400941623802934634034503988015814",
"229744517319141011807067723528336310712",
"5470774793808843884470351154813256077",
"85584800880178566132965871496154389366",
"201714373136485406076122284068139384105",
"166128759268874274397782369272194955390",
"165408801408455630931598490036002266684",
"240891851488475861129443917702697003462"
],
"threshold": 0.9
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Line",
"id": "PUB-A-218679614-280df52b"
},
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"length": 210.0,
"function_hash": "299710883315706878087550130637010617808"
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"function": "createPreferenceControllers",
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Function",
"id": "PUB-A-218679614-59dd49c5"
},
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"length": 116.0,
"function_hash": "151139331555998242376810044643808306534"
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"function": "isPageSearchEnabled",
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Function",
"id": "PUB-A-218679614-76558797"
},
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"length": 686.0,
"function_hash": "157878402040775359214360462482213830193"
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"function": "onCreate",
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Function",
"id": "PUB-A-218679614-83e9ed50"
},
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"length": 224.0,
"function_hash": "58384431947728290635321662528093739040"
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"function": "onActivityResult",
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Function",
"id": "PUB-A-218679614-cf604312"
},
{
"source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1f0689f73ce1e1d266a35bc3cdfaf72a442048f6",
"deprecated": false,
"digest": {
"length": 180.0,
"function_hash": "130005293808641737841938730640936793694"
},
"match_only_versions": [
"13"
],
"signature_version": "v1",
"target": {
"function": "onAttach",
"file": "src/com/android/settings/wifi/ConfigureWifiSettings.java"
},
"signature_type": "Function",
"id": "PUB-A-218679614-dcdd8fb3"
}
],
"types": [
"EoP"
],
"severity": "Moderate",
"spl": "2022-12-01"
}