{"id":"ASB-A-191981182","details":"In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-191981182","CVE-2021-0981"],"modified":"2026-05-25T16:46:24.913870386Z","published":"2022-07-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-07-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/6f657f8f5b7d41af426d6cd8d60bfda6e12057c0"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-07-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b6b2906ea6472d182e6ae03c581a63802cd84f08"],"vanir_signatures":[{"deprecated":false,"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"signature_type":"Line","signature_version":"v1","id":"ASB-A-191981182-533baa6b","digest":{"threshold":0.9,"line_hashes":["240037727117598053934682089445336783166","329474040879582449953478552907453855546","174673651793102388188071638934257456124","259588229805424313728476384333440510658","155696764481876506922343483232310471129"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/b6b2906ea6472d182e6ae03c581a63802cd84f08"},{"signature_type":"Function","id":"ASB-A-191981182-a4fa6473","digest":{"length":3611,"function_hash":"196748049840613594069406754919439538533"},"deprecated":false,"target":{"function":"enqueueNotificationInternal","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b6b2906ea6472d182e6ae03c581a63802cd84f08"}],"severity":"High","types":["EoP"],"spl":"2022-07-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191981182.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-07-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cb3c5c30092fb8527ff14118ccf04eae3a8363cb"],"vanir_signatures":[{"id":"ASB-A-191981182-93d7ece6","digest":{"length":4610,"function_hash":"72877579714271495606303148392477615046"},"target":{"function":"enqueueNotificationInternal","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/platform/frameworks/base/+/cb3c5c30092fb8527ff14118ccf04eae3a8363cb"},{"deprecated":false,"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"signature_type":"Line","signature_version":"v1","id":"ASB-A-191981182-e10fe9cb","digest":{"threshold":0.9,"line_hashes":["13549590592486121308503808933030620588","148911571839698110200170276866997909263","212918861559158536384170514703963432599","269490775990843939007528372060340186886"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/cb3c5c30092fb8527ff14118ccf04eae3a8363cb"}],"severity":"High","types":["EoP"],"spl":"2022-07-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-191981182.json"}}],"schema_version":"1.7.5"}