Possible EvilParcel bug in GeofenceHardwareRequestParcelable class

2022-06-0100:00:00

Google

osv.dev

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/frameworks/baseeq10
platform/frameworks/baseeq11
platform/frameworks/baseeq12
platform/frameworks/baseeq12L

Name	Operator	Version
platform/frameworks/base	eq	10
platform/frameworks/base	eq	11
platform/frameworks/base	eq	12
platform/frameworks/base	eq	12L

References

android.googlesource.com/platform/frameworks/base/+/e20d8ae7104f3235c8a2d72c85d19644e2ac8d86

source.android.com/security/bulletin/2022-06-01