In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "113368717759628274477408347327049385499", "106236305416753461708058851782728867857", "123952664856933728363103700178935683844", "38188645671126462879146263802154555363", "66867937003104838469130127728366996005" ] }, "id": "PUB-A-235863754-0a19d503", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/P2pLinkManager.java" }, "signature_type": "Line" }, { "digest": { "length": 6413.0, "function_hash": "95551004231875802888955028014464940643" }, "id": "PUB-A-235863754-3a3d9bd4", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/NfcService.java", "function": "NfcService" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 260.0, "function_hash": "151596844345028927167209382184510404745" }, "id": "PUB-A-235863754-44e04203", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "getForegroundUids" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 1207.0, "function_hash": "269906288094771997997078629465090375353" }, "id": "PUB-A-235863754-4c397918", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "onForegroundActivitiesChanged" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 962.0, "function_hash": "148965707076149533274898962024070495598" }, "id": "PUB-A-235863754-59790cc7", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/NfcDispatcher.java", "function": "NfcDispatcher" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 228.0, "function_hash": "251785830487760310581530692788314388116" }, "id": "PUB-A-235863754-5c573572", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/cardemulation/EnabledNfcFServices.java", "function": "EnabledNfcFServices" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 921.0, "function_hash": "153930257536859515901092612258230180703" }, "id": "PUB-A-235863754-629ac9ca", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/P2pLinkManager.java", "function": "P2pLinkManager" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "210382596190231453337606575910378429006", "51020232370656901331264890752182517429", "81679950842153502634815720970967472692", "121367048220908777545919911419561640983", "57142219199878633579456205442553422529", "138714224860062456865536624266842254201", "308917684074691662180229356558082991614", "299214850159013629302255749174130222236", "229287136243659993471925178829631474917", "129707050768414709815201312211424303435", "15744165097626741040427971821130512038", "28607463902427991154004858271435720201", "127924147280425649364280613209242477563", "282619552376880317283320539735272812579", "116772877183742207565538096566007880045", "209975059658092021464722099974859436677", "21706662990629354376934580009010517663", "264542521035004924727001142026091353465", "252382140636150596270998419798060508411", "190507113248610212216628348824559104526", "269503341997195297820850374598465963896", "122087041477080931364948152044563825263", "138153037577516560852314534284306638550", "4986412396634294708778054089070692382", "99711005680037310866119821800818736443", "153604852517654474602115004349604321806" ] }, "id": "PUB-A-235863754-67359f4d", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/NfcDispatcher.java" }, "signature_type": "Line" }, { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "33277098378610753753574125478525365266", "106206246771678479333480200358196409364", "224046875215136698336786354386755497338", "208366509962424477176156710678697974071", "224390156192045685798679302985298123631", "139824083821349149528410798838689598740", "197049685357023789240623603921657373834", "328830284262320936423291937817380222128" ] }, "id": "PUB-A-235863754-6d624ec1", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/cardemulation/PreferredServices.java" }, "signature_type": "Line" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 233.0, "function_hash": "46699237657416907649158421535587550500" }, "id": "PUB-A-235863754-98355911", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "ForegroundUtils" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "141049546801717307847681922068922541697", "56970147429017582244198714648678274608", "166836253386382856689211011533268573428", "288150189314088709600170454852186255407", "190325243924840083651277250723093364666", "218272129041883398442381758381319642373", "195081792710810610799861562847493522497", "199865999683196455789576721816343007740", "217419274733756772061396744960172223795" ] }, "id": "PUB-A-235863754-9c4996de", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/cardemulation/EnabledNfcFServices.java" }, "signature_type": "Line" }, { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "206818311893447892725277503258120020257", "138872056766741854602359000474839509716", "241331321945921584349723402094314126125", "210207811995479180435565916679119284318", "62589874562278270513586371892903644793", "202889494381416009949109766796020185992", "251016742637368097826056079232112830188", "59780332181224017537721392959317083247", "73938003973741712052554672335840564413", "238605347165475371215269460813801504288", "307662737433537777026352890698782886967", "127726067545621689623865158920696924978", "237398387834923433475388027080997204899", "110616713132140603807516209581041049204", "270563169033963422823771179611430755299", "220842982631831774438572384882362806532", "324144219126876393548260222639160826576", "296822635998146797513197839330049017215", "114337492652890772678668251071493237959", "24787021561093090121089834892160382510", "176375021106069483586326325861025474192", "27532848673465032371492794333337920682", "80460896022750260426148573156789298670", "241549507320799035339376742123717543728", "338823046210517032662600043828340033833", "37046974162814211913669503407702194487", "229013816660794316975241244987929261266", "291185642160427553238856855998278152630", "259629404852296308152812749160721262237", "258678500846632467731326391351763687135", "48505379325706776299084461423287653984", "104070106626497582512383174321894918641", "41208233471727504823065891640767717273", "142792574061456485356845985637082786508", "205341327772313084101836156216086654827", "153221833785745585519257460707129079024", "186626630879532378106735517169270332862", "38444158523899598999102500176342698820", "78468798119960672566856607837888026538", "112074967135628187933031104744034706779", "41914035865517055663951722083957253179", "157242106229882745621282826466523424162", "154075683330494630874298542986204860479", "141459742145787108577521010139716448299", "275553499901619688645337486966239406629", "273100650273632927204780520121309051204", "262338771730304969660449334177009069293", "134339610523808891631353120945039178226", "93976077494556945749663584250804335543", "91855346635057604716268763848652983685", "119979796408235658679855397244195061044", "60299622313328034757618496300900061674", "110523784907821073878680945913523658764", "165811726834539803922877368810096957579", "213791502406478725762994687676705721468", "222744635210817235125111889325391842863", "232018342234695755004170729255294472182", "205677520796042754807782728655437557824", "130097929644860223349922054440948010191", "247586737230525810350929747008288845130", "50365092404821582345732878091821498843", "105471234071892555279037981605407015786", "23003638424607864333304663837823528620", "230592756871603197709947465648535138666", "133368122527581515210558836927720209246", "268591853684688854651051342861642375287", "294920810097490310877808686222086671906", "272871732904100740204323609663534576360", "78588153024476789339048402749608876043", "233074782395142421486352921680624029344", "299751044813753115464268285731421781023", "11526315367848622825330784589022150503", "290511789934914987767075537213344909924", "59600742908482582027109554656281312293", "252910874106050693551137343471831114192", "172809589000894659377087146012972006762", "141413328069494352048327933712625258814", "329395391147393917775609648550982688664", "307028663088328169272129969121864999940", "63812419612009393933519765348981130430", "99020960237584140776521289352296566337", "109496503627833802174874980923681756235", "16711635349882914863390104955971685908", "134602289765904303955355794309299256863", "146557274161323046599957400585769848034", "250394315958330159295085699484187639404", "195741567580544395158700280485042369417", "72517717682901513625390392790185547056", "245316871234616537046107692593663254938", "108587633537507210242609878158511307392", "295747577431459138783214723720080232905", "297534453771733428204308995395549877625", "311763565715736558471428174805258329581", "75966663624920989741192548848793121342", "169100729244442268167126876360262639942", "227225460703533309064771830414929834045", "71995875146710740006321229778497311469", "258746052203952224224504567397747831641", "55624969711793275362238144939346720168", "85402613448957525940769670694010037105" ] }, "id": "PUB-A-235863754-a5d5e909", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java" }, "signature_type": "Line" }, { "match_only_versions": [ "13-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "116515123230020406264291184691781453251", "338691078231962965822518594318811708058", "207731861661788108250832531628171736884", "112611083181945458269547450470972362410", "302218063876937785305259002897866846769", "177070072434733598529418707498396671568", "35377439835205396190662568349998184714", "204587445056614226244476385832926054594", "317262670652140800573172607647913483436", "107874283220397684675685094308512942875", "321212111790477230513309724416659434777", "151428888945119188542919567687632998671", "254338628593764171373775168773021314319", "272920679159327023947919623392645685958" ] }, "id": "PUB-A-235863754-b04ec37e", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/NfcService.java" }, "signature_type": "Line" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 239.0, "function_hash": "86766545137959801990306582498579675298" }, "id": "PUB-A-235863754-c92c8e34", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "onProcessDied" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 52.0, "function_hash": "114315904009849912722183282979987656879" }, "id": "PUB-A-235863754-dc86ede0", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "getInstance" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 478.0, "function_hash": "312261398737595737790716776500494988536" }, "id": "PUB-A-235863754-fb4cc924", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/cardemulation/PreferredServices.java", "function": "PreferredServices" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 97.0, "function_hash": "150845043335634371036321878535780902454" }, "id": "PUB-A-235863754-fe662c3e", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/NfcDispatcher.java", "function": "resumeAppSwitches" }, "signature_type": "Function" }, { "match_only_versions": [ "13-next" ], "digest": { "length": 401.0, "function_hash": "138216242949661086136514442893531237393" }, "id": "PUB-A-235863754-ff546d83", "source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c", "deprecated": false, "signature_version": "v1", "target": { "file": "src/com/android/nfc/ForegroundUtils.java", "function": "isInForegroundLocked" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/packages/apps/Nfc/+/8edf64d5f3f1c5500cdb083e01764e957776b27c" ], "spl": "2023-06-01", "severity": "Moderate", "types": [ "EoP" ] }