Lucene search

GoogleOSV:ASB-A-189942529

HistoryMay 01, 2023 - 12:00 a.m.

Possible Vulnerability in Work Profile Provisioning

2023-05-0100:00:00

Google

osv.dev

vulnerability

work profile

sms

permissions bypass

information disclosure

user execution

exploitation

software

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due to a permissions bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/modules/permissioneq11
platform/frameworks/baseeq11

CPE	Name	Operator	Version
	platform/packages/modules/permission	eq	11
	platform/frameworks/base	eq	11

References

android.googlesource.com/platform/frameworks/base/+/0b486e312fd0dd041cb29113ade3517fba1783c7

source.android.com/security/bulletin/2023-05-01

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:ASB-A-189942529