In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"function_hash": "239135965997494739458696623849500405979",
"length": 2207.0
},
"id": "PUB-A-266700762-7103ca74",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/61aed07783d93b2a3cbeb2a1a0f40c560bd14b2b",
"deprecated": false,
"target": {
"function": "needNetworkFor",
"file": "service/java/com/android/server/wifi/WifiNetworkFactory.java"
},
"signature_version": "v1"
},
{
"digest": {
"function_hash": "311661579839707545632783702909289347180",
"length": 1860.0
},
"id": "PUB-A-266700762-f2bf2ae0",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/61aed07783d93b2a3cbeb2a1a0f40c560bd14b2b",
"deprecated": false,
"target": {
"function": "acceptRequest",
"file": "service/java/com/android/server/wifi/WifiNetworkFactory.java"
},
"signature_version": "v1"
}
],
"types": [
"EoP"
],
"spl": "2023-06-01",
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/61aed07783d93b2a3cbeb2a1a0f40c560bd14b2b"
],
"severity": "Moderate"
}
{
"vanir_signatures": [
{
"digest": {
"function_hash": "312101056247928488820036140934587144301",
"length": 1783.0
},
"id": "PUB-A-266700762-422fd868",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/be4e652bf598831d2d8576bc601ca7dd4286ca36",
"deprecated": false,
"target": {
"function": "acceptRequest",
"file": "service/java/com/android/server/wifi/WifiNetworkFactory.java"
},
"signature_version": "v1"
},
{
"digest": {
"function_hash": "298646921894877777740840376430943233976",
"length": 2109.0
},
"id": "PUB-A-266700762-b49313ba",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/be4e652bf598831d2d8576bc601ca7dd4286ca36",
"deprecated": false,
"target": {
"function": "needNetworkFor",
"file": "service/java/com/android/server/wifi/WifiNetworkFactory.java"
},
"signature_version": "v1"
}
],
"types": [
"EoP"
],
"spl": "2023-06-01",
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/be4e652bf598831d2d8576bc601ca7dd4286ca36"
],
"severity": "Moderate"
}