ASB-A-294228721

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-294228721.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-294228721

Aliases

A-294228721
CVE-2023-40089

Published

2023-12-01T00:00:00Z

Modified

2024-08-07T19:29:32.643485Z

Summary

Disallowed credential managers are not disabled in settings

Details

In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select credential managers without permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

14-next:0

Fixed

14-next:2023-12-01

Affected versions

Other

14-next

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 307.0,
                "function_hash": "74449242559593116633127182544354130666"
            },
            "id": "ASB-A-294228721-001b2075",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/892ba1d6f6b08667d3a7741e698c1ccfbd3841f5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
                "function": "getCredentialManagerPolicy"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 206.0,
                "function_hash": "273187886863558320177264236917531010900"
            },
            "id": "ASB-A-294228721-0d7ed67a",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/892ba1d6f6b08667d3a7741e698c1ccfbd3841f5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/app/admin/DevicePolicyManager.java",
                "function": "getCredentialManagerPolicy"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "27048490247006646627419795221021812496",
                    "175284641402637478608390869535606810161",
                    "234065406732064679832854187106009601004",
                    "197420965643697283682808876633612224374",
                    "234819912256778732340493599341448481647",
                    "300102070284684225849613243206591386726",
                    "340068429391398980206455874537492563893",
                    "216495480719551252986048293592306024957"
                ]
            },
            "id": "ASB-A-294228721-633b9ba6",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/892ba1d6f6b08667d3a7741e698c1ccfbd3841f5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/app/admin/DevicePolicyManager.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "332219673355443387379256206211042897860",
                    "35632985352020364848489662231319506689",
                    "76320284361625687917528082129015246115",
                    "73129828535204244091363231259897667037",
                    "250217290926877900967568290098458981441",
                    "270938730645888615323830826130448163534",
                    "305815705679108351074771310580648973669",
                    "208232285445090970418086043977411258726",
                    "264785142350393791605780235158664188932",
                    "162567613217633417994253022385408772313",
                    "295760383498470438294263347900256242793",
                    "202167732107955505056331426613111159753"
                ]
            },
            "id": "ASB-A-294228721-ae13115d",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/892ba1d6f6b08667d3a7741e698c1ccfbd3841f5",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/892ba1d6f6b08667d3a7741e698c1ccfbd3841f5"
    ],
    "spl": "2023-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}