In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "spl": "2022-12-01", "severity": "Moderate", "fixes": [ "https://android.googlesource.com/platform/packages/apps/Settings/+/2c1b1aa81346c68179a88bad31f23ed976517954" ], "vanir_signatures": [ { "signature_version": "v1", "target": { "file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java" }, "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/2c1b1aa81346c68179a88bad31f23ed976517954", "signature_type": "Line", "digest": { "line_hashes": [ "293101183722590943478867740640679466749", "108412991053796078583091860813531505642", "28035893926855174962940746953580967671", "40112860432468891969057084409714236080", "177480183194004016276858230791931740979", "172276761039711939950469013439173632504", "101497221201453250963401664882264014271" ], "threshold": 0.9 }, "id": "PUB-A-220733496-2194e862", "match_only_versions": [ "13" ], "deprecated": false }, { "signature_version": "v1", "target": { "function": "updatePreferenceIntents", "file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java" }, "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/2c1b1aa81346c68179a88bad31f23ed976517954", "signature_type": "Function", "digest": { "length": 1306.0, "function_hash": "320241958175093881091290427079770006414" }, "id": "PUB-A-220733496-44bfe572", "match_only_versions": [ "13" ], "deprecated": false }, { "signature_version": "v1", "target": { "function": "onPreferenceClick", "file": "src/com/android/settings/accounts/AccountTypePreferenceLoader.java" }, "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/2c1b1aa81346c68179a88bad31f23ed976517954", "signature_type": "Function", "digest": { "length": 322.0, "function_hash": "205161867117239727942345407947753384515" }, "id": "PUB-A-220733496-8b6827fe", "match_only_versions": [ "13" ], "deprecated": false } ], "types": [ "ID" ] }