Android vulnerabilities

Android allows users to cause a denial of service.

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.

In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.

In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.

In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.

In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.

In the addWindow method of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.

In the onNullBinding method of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed.

In the getCallingPackageName method of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.

In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In getAppLabel of ForgetDeviceDialogFragment.java, misleading UI can trick the user into forgetting a device, leading to local escalation of privilege.

In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, misleading UI due to obfuscation could lead to local escalation of privilege.

In multiple locations, a way to execute code in the launcher process due to an over-privileged shell user could lead to local escalation of privilege.

In multiple functions of PackageInstallerService.java, a missing permission check allows installing unverified apps, leading to local escalation of privilege.

In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In applySimpleFieldMaxSize in DataRowHandler.java, improper input validation could allow inserting a very long contact name, leading to local denial of service without additional privileges.

In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the validateNode function in ResourceTypes.cpp, there is a potential out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In getPreferredSize in LauncherProcessImageListener.kt, a denial of service can occur due to resource exhaustion, leading to local denial of service without additional privileges.

In functions of DevicePolicyManagerService.java, a way to hide a system critical package was found due to improper input validation. This could lead to local denial of service without additional privileges.

In verifySignature of ApkChecksums.java, a crash can be caused due to resource exhaustion. This leads to local denial of service without additional privileges.

In functions of ubsan_throwing_runtime.cpp, a logic error can lead to permanent denial of service. No additional privileges or user interaction are needed.

In functions of WindowState.java, a user can be tricked into accepting a permission via a tapjacking/overlay attack. This could lead to local privilege escalation without additional privileges.

In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, a potential persistent denial of service issue exists due to an unusual root cause. This leads to local denial of service without additional privileges.

In the setTo function of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the bta_jv_rfcomm_connect function in bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In functions of ubsan_throwing_runtime.cpp, an integer overflow can lead to persistent denial of service and local privilege escalation. No additional privileges or user interaction are needed.

In functions of ubsan_throwing_runtime.cpp, resource exhaustion can lead to persistent denial of service. No additional privileges or user interaction are needed.

In startAnimation of StageCoordinator.java, a tapjacking issue due to overlay attack could lead to local escalation of privilege.

In functions of AccessibilityManagerService.java, improper input validation can lead to persistent denial of service. No additional privileges or user interaction are needed.

In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In the performPreInstallChecks function in InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In isSameApp of NotificationManagerService.java, resource exhaustion can lead to persistent denial of service. No additional privileges or user interaction are needed.

A logic error in KeyguardViewMediator.java allows bypassing lockdown mode via screen pinning. This could lead to local information disclosure without additional privileges or user interaction.

In functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.