In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "match_only_versions": [ "14-next" ], "digest": { "length": 1765.0, "function_hash": "304035088418154940298140047792083108653" }, "id": "ASB-A-218495634-3ee4b5f4", "source": "https://android.googlesource.com/platform/frameworks/base/+/eaa129138096bc00b663bca93a5af9786aa47154", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "338814834109456929542983709409882127925", "235046293542743996481827584209451882372", "130348584427896853783720480792833319267", "217891011864391169958289907302504721507", "217418388879626796576064260608026994421", "117398066363718461550302793515953941213", "79579155316272236099396944078956801381", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-45038a40", "source": "https://android.googlesource.com/platform/frameworks/base/+/5fba6ecb07c70dfc229a63249bf105c09ebea5b3", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 1690.0, "function_hash": "284928268195077554313356089549994834202" }, "id": "ASB-A-218495634-61e9f168", "source": "https://android.googlesource.com/platform/frameworks/base/+/6962dbcd2eaf91552eb243aff0c0b95e567d27ca", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "length": 1058.0, "function_hash": "211568497414698919367859280100150776245" }, "id": "ASB-A-218495634-6e660d0f", "source": "https://android.googlesource.com/platform/frameworks/base/+/5fba6ecb07c70dfc229a63249bf105c09ebea5b3", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "setKeyguardEnabled" }, "signature_type": "Function" }, { "digest": { "length": 1899.0, "function_hash": "282054692786184338632886146874546627123" }, "id": "ASB-A-218495634-6ece7b7c", "source": "https://android.googlesource.com/platform/frameworks/base/+/5fba6ecb07c70dfc229a63249bf105c09ebea5b3", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "217418388879626796576064260608026994421", "117398066363718461550302793515953941213", "79579155316272236099396944078956801381", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-93272fe3", "source": "https://android.googlesource.com/platform/frameworks/base/+/6962dbcd2eaf91552eb243aff0c0b95e567d27ca", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 126.0, "function_hash": "164145264476987166990141801887261171742" }, "id": "ASB-A-218495634-af6d0406", "source": "https://android.googlesource.com/platform/frameworks/base/+/d341f1ecdb011d24b17358f115391b3f997cb179", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java", "function": "isUserInLockdown" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272270452350211199257198546000141914512", "257440768328920567759603761498527279656", "257375862310022298453890776217171196166", "192275060805609577122740357272531972185", "180343007323809834027214850269342888344" ] }, "id": "ASB-A-218495634-c0ab722f", "source": "https://android.googlesource.com/platform/frameworks/base/+/d341f1ecdb011d24b17358f115391b3f997cb179", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/6962dbcd2eaf91552eb243aff0c0b95e567d27ca", "https://android.googlesource.com/platform/frameworks/base/+/eaa129138096bc00b663bca93a5af9786aa47154", "https://android.googlesource.com/platform/frameworks/base/+/5fba6ecb07c70dfc229a63249bf105c09ebea5b3", "https://android.googlesource.com/platform/frameworks/base/+/d341f1ecdb011d24b17358f115391b3f997cb179" ], "spl": "2024-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "117754117023511617074158434862532964623", "147002207580473411054580735676814976493", "52347062470120794657509929392400327333", "200483584294585194090306010838328625676", "338814834109456929542983709409882127925", "76277769511094972638620369272886416134", "277280833309207451959715782456959379720", "67033325747926034528272846521866955627", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-12705bdb", "source": "https://android.googlesource.com/platform/frameworks/base/+/35a6e2f2c952440b1102033b2c3e496438503cff", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 1800.0, "function_hash": "29627298081105970609613652423815629009" }, "id": "ASB-A-218495634-2f9772be", "source": "https://android.googlesource.com/platform/frameworks/base/+/b23c2d5fb6630ea0da503b937f62880594b13e94", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "match_only_versions": [ "12" ], "digest": { "threshold": 0.9, "line_hashes": [ "321078170511436082815421945439303964918", "209075073039546049612323819951124502855", "38867570063675643553038483487100176832", "163776543271928782038002134823982461851", "199000920925165640654848569466156005191", "215446848326935019446492765767272069821", "63600452582391826383090743203247594651", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "194106854631581517597473156519242648953", "312210675924005357704594287898063409327", "315734703629131880403629904844485908198", "100286155624185491953001507421476672040", "71450432977344244041028199960832290641" ] }, "id": "ASB-A-218495634-40c02f03", "source": "https://android.googlesource.com/platform/frameworks/base/+/f57217125f2b124c16c463ef4507fb054cc1ba4f", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 126.0, "function_hash": "164145264476987166990141801887261171742" }, "id": "ASB-A-218495634-483d9aab", "source": "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java", "function": "isUserInLockdown" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272270452350211199257198546000141914512", "257440768328920567759603761498527279656", "257375862310022298453890776217171196166", "192275060805609577122740357272531972185", "180343007323809834027214850269342888344" ] }, "id": "ASB-A-218495634-5406c5c7", "source": "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java" }, "signature_type": "Line" }, { "digest": { "length": 1800.0, "function_hash": "29627298081105970609613652423815629009" }, "id": "ASB-A-218495634-62d9473e", "source": "https://android.googlesource.com/platform/frameworks/base/+/35a6e2f2c952440b1102033b2c3e496438503cff", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "length": 1526.0, "function_hash": "331068652250228229410556917598763118258" }, "id": "ASB-A-218495634-82e3ef3a", "source": "https://android.googlesource.com/platform/frameworks/base/+/35a6e2f2c952440b1102033b2c3e496438503cff", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "setKeyguardEnabled" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "220310136718772719307917260366092307983", "314875774106075139139586693072120148273", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-df4e1334", "source": "https://android.googlesource.com/platform/frameworks/base/+/b23c2d5fb6630ea0da503b937f62880594b13e94", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/b23c2d5fb6630ea0da503b937f62880594b13e94", "https://android.googlesource.com/platform/frameworks/base/+/f57217125f2b124c16c463ef4507fb054cc1ba4f", "https://android.googlesource.com/platform/frameworks/base/+/35a6e2f2c952440b1102033b2c3e496438503cff", "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15" ], "spl": "2024-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "length": 126.0, "function_hash": "164145264476987166990141801887261171742" }, "id": "ASB-A-218495634-32516721", "source": "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java", "function": "isUserInLockdown" }, "signature_type": "Function" }, { "digest": { "length": 1812.0, "function_hash": "155677678749220361913751173285224346215" }, "id": "ASB-A-218495634-437aa946", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-693e8e81", "source": "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272270452350211199257198546000141914512", "257440768328920567759603761498527279656", "257375862310022298453890776217171196166", "192275060805609577122740357272531972185", "180343007323809834027214850269342888344" ] }, "id": "ASB-A-218495634-a25a9c08", "source": "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "338814834109456929542983709409882127925", "76277769511094972638620369272886416134", "277280833309207451959715782456959379720", "67033325747926034528272846521866955627", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-acde954b", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 1526.0, "function_hash": "331068652250228229410556917598763118258" }, "id": "ASB-A-218495634-b8435b7f", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "setKeyguardEnabled" }, "signature_type": "Function" }, { "digest": { "length": 1812.0, "function_hash": "155677678749220361913751173285224346215" }, "id": "ASB-A-218495634-ead9796e", "source": "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "https://android.googlesource.com/platform/frameworks/base/+/996896e672f28aa96a3d8158192de3cd4a105bc3", "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "https://android.googlesource.com/platform/frameworks/base/+/ce7ca2d9f405c94062504411c886eff93bd7ce15" ], "spl": "2024-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "length": 126.0, "function_hash": "164145264476987166990141801887261171742" }, "id": "ASB-A-218495634-017bbde5", "source": "https://android.googlesource.com/platform/frameworks/base/+/ba8dfc68aada76127abafdb17d0f0896cc14447a", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java", "function": "isUserInLockdown" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-3e99b13a", "source": "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272270452350211199257198546000141914512", "257440768328920567759603761498527279656", "257375862310022298453890776217171196166", "192275060805609577122740357272531972185", "180343007323809834027214850269342888344" ] }, "id": "ASB-A-218495634-5915fff1", "source": "https://android.googlesource.com/platform/frameworks/base/+/ba8dfc68aada76127abafdb17d0f0896cc14447a", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java" }, "signature_type": "Line" }, { "digest": { "length": 1812.0, "function_hash": "155677678749220361913751173285224346215" }, "id": "ASB-A-218495634-701a2f51", "source": "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "length": 1526.0, "function_hash": "331068652250228229410556917598763118258" }, "id": "ASB-A-218495634-7131e955", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "setKeyguardEnabled" }, "signature_type": "Function" }, { "digest": { "length": 1812.0, "function_hash": "155677678749220361913751173285224346215" }, "id": "ASB-A-218495634-d8756dda", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "338814834109456929542983709409882127925", "76277769511094972638620369272886416134", "277280833309207451959715782456959379720", "67033325747926034528272846521866955627", "9365234353361314461788575334639075382", "216674733824327627720162398157613970915", "18918454448934535819593285805422419524", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-e0c66df4", "source": "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/100ae42365d7fc8ba7d241e8c9a7ef6aa0cdb961", "https://android.googlesource.com/platform/frameworks/base/+/996896e672f28aa96a3d8158192de3cd4a105bc3", "https://android.googlesource.com/platform/frameworks/base/+/faaf58d3b910c388b0a7c51dc370a7ae18e7cec2", "https://android.googlesource.com/platform/frameworks/base/+/ba8dfc68aada76127abafdb17d0f0896cc14447a" ], "spl": "2024-04-01", "severity": "High", "types": [ "ID" ] }
{ "vanir_signatures": [ { "digest": { "length": 1058.0, "function_hash": "211568497414698919367859280100150776245" }, "id": "ASB-A-218495634-04d84c3a", "source": "https://android.googlesource.com/platform/frameworks/base/+/d9c7c85c52c007fdedb177b9f5f98821d0a76090", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "setKeyguardEnabled" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "272270452350211199257198546000141914512", "257440768328920567759603761498527279656", "257375862310022298453890776217171196166", "192275060805609577122740357272531972185", "180343007323809834027214850269342888344" ] }, "id": "ASB-A-218495634-3a33e379", "source": "https://android.googlesource.com/platform/frameworks/base/+/93149616ba8255ec82877e43d4b41c2ebd6abf24", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "330577154200106067971632765567004937555", "317299657746041441650624568340216412263", "315451126314009829077727818078369864571", "209772627120838804278847583393078607", "338814834109456929542983709409882127925", "235046293542743996481827584209451882372", "130348584427896853783720480792833319267", "217891011864391169958289907302504721507", "217418388879626796576064260608026994421", "117398066363718461550302793515953941213", "79579155316272236099396944078956801381", "171752403606268139558195332375681780149" ] }, "id": "ASB-A-218495634-652debab", "source": "https://android.googlesource.com/platform/frameworks/base/+/d9c7c85c52c007fdedb177b9f5f98821d0a76090", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java" }, "signature_type": "Line" }, { "digest": { "length": 126.0, "function_hash": "164145264476987166990141801887261171742" }, "id": "ASB-A-218495634-67b7bd30", "source": "https://android.googlesource.com/platform/frameworks/base/+/93149616ba8255ec82877e43d4b41c2ebd6abf24", "deprecated": false, "signature_version": "v1", "target": { "file": "core/java/com/android/internal/widget/LockPatternUtils.java", "function": "isUserInLockdown" }, "signature_type": "Function" }, { "digest": { "length": 1690.0, "function_hash": "284928268195077554313356089549994834202" }, "id": "ASB-A-218495634-fee48d2d", "source": "https://android.googlesource.com/platform/frameworks/base/+/d9c7c85c52c007fdedb177b9f5f98821d0a76090", "deprecated": false, "signature_version": "v1", "target": { "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function": "doKeyguardLocked" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/eaa129138096bc00b663bca93a5af9786aa47154", "https://android.googlesource.com/platform/frameworks/base/+/d9c7c85c52c007fdedb177b9f5f98821d0a76090", "https://android.googlesource.com/platform/frameworks/base/+/93149616ba8255ec82877e43d4b41c2ebd6abf24" ], "spl": "2024-04-01", "severity": "High", "types": [ "ID" ] }