ASB-A-209607104

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-209607104.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-209607104

Aliases

A-209607104
CVE-2021-39797

Published

2022-04-01T00:00:00Z

Modified

2024-08-07T19:30:03.323560Z

Summary

LauncherApps.getMainActivityLaunchIntent allows launching activities into tasks of other apps

Details

In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12:0

Fixed

12:2022-04-01

Affected versions

Other

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 333.0,
                "function_hash": "137248387484537822829252118485141517099"
            },
            "id": "ASB-A-209607104-088ccb7a",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/content/pm/LauncherApps.java",
                "function": "getMainActivityLaunchIntent"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 543.0,
                "function_hash": "28162110024036208773396514272508563557"
            },
            "id": "ASB-A-209607104-144b9735",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/pm/LauncherAppsService.java",
                "function": "getActivityLaunchIntent"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 209.0,
                "function_hash": "316721006222484432174288414543312406339"
            },
            "id": "ASB-A-209607104-50c3a0a7",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/pm/LauncherAppsService.java",
                "function": "injectCreatePendingIntent"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 419.0,
                "function_hash": "209368282351262600398357506955008752116"
            },
            "id": "ASB-A-209607104-6f24fd45",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/content/pm/LauncherApps.java",
                "function": "getShortcutIntent"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "208657842323585617199440622118754555280",
                    "188543004290221367998040737249986687817",
                    "89268067444872410921236962549652080505",
                    "330160537554672763508440278627193783841",
                    "336203847567176194881074659462724657280",
                    "16014099923058085021415620949231701106",
                    "45156579175837308352023695108033224999",
                    "29497062090299132957836227691724338011"
                ]
            },
            "id": "ASB-A-209607104-6fdff88d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/pm/LauncherAppsService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "323056489602489480626555281834963073386",
                    "120527124750163839005716455172243298742",
                    "174241891141466154865567032718734644680",
                    "124061312468540906288334305132361158070",
                    "130044595969274989620788393110112093113",
                    "269197518101157401882084573960619533219",
                    "221771215959718339465454391941265922746",
                    "323056489602489480626555281834963073386",
                    "54260101725757807824306946882002898312",
                    "48884956928022838782230178579222540489",
                    "243800009251414036841401877123628114651",
                    "168866404118292972998755613034021737919",
                    "290239591681633831098119702524040302558",
                    "313293555265765302587783741313800669602",
                    "304154884390663653896821965983558836315",
                    "238416410560095626289164229990428974207"
                ]
            },
            "id": "ASB-A-209607104-73a66010",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/content/pm/LauncherApps.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e41e04bb8cb930c079597bc0008540461c57ffe1"
    ],
    "spl": "2022-04-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}