{"id":"ASB-A-194695497","details":"In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-194695497","CVE-2021-39626"],"modified":"2026-05-26T15:46:26.044149249Z","published":"2022-01-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-01-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/3f280c15b1808a94acd3ce2c4145c74e6f183855"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2022-01-01"}]}],"versions":["9"],"ecosystem_specific":{"spl":"2022-01-01","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","id":"ASB-A-194695497-0abec21d","digest":{"line_hashes":["122436655769960876950327506539057899134","85936768693390141581032637767414632546","26834401021624556130836192422891320233","87447767317621775843721729129572274897","300760323630716146045699634891843242882","222327848783132382432003289128134544423","216215073306296065314012340413239016032","88713409712068162077860391235105736219","39261359632743984324474902002462018212","24211135599265295438470766186359504518","1005306557762615373626565662367547709","170149756272429903689796819935110646491","21388436887348979908371249288545844726","64335299588713598197799131681995517259","88307514168109242932365026040610766779","3674160039292587285849858495930910657","138824602437083469331565032904689436529","223488986215449101054309837505325390408","19364766549390664423382284233988628430","6808611186853965903113183353507673168","118990646222525498351112552386115424734","310799688535784630251187413576798147420"],"threshold":0.9},"deprecated":false,"signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"signature_type":"Line"},{"match_only_versions":["9"],"id":"ASB-A-194695497-1e1bf43f","signature_version":"v1","deprecated":false,"digest":{"function_hash":"268238997001670844559971242648097791445","length":107},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","target":{"function":"init","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","id":"ASB-A-194695497-20302f9c","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onPause","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"179416585184535575631683987443604216282","length":111}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","id":"ASB-A-194695497-8360ac17","deprecated":false,"signature_type":"Line","signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"digest":{"line_hashes":["78854732571040967907927662601738678612","335940109855155077124864081825439259544","110343704322006136596666770970428274283","74985741228474719343234102010223948256","32363225495246370601200884544494355510","107371975565343768832202982237512898634","200779139782422243295946451707250738602","151435939648656856922169056879765873245","293896055190481927883941316866386521470","124337164737968615162218777642052250404","82238793093865936609388420905358765395","19897069738504487259929902965143711465","189655131381408458353547443116022135341","8924831491191744649092821175969637167","245551475002278065297110278709164080564","67968165297240889273404703384658113822","196444368393633963089543646432763125962"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","id":"ASB-A-194695497-e56a53f8","digest":{"function_hash":"190711648362598552797040191985779008202","length":214},"deprecated":false,"signature_version":"v1","target":{"function":"onResume","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5","id":"ASB-A-194695497-f9d3648b","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onAttach","file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"digest":{"function_hash":"64120534816708702707614246021414511636","length":259}}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/f8cd68c6e2440f541c77c1e7e299aaca432c05c5"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-194695497.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-01-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2022-01-01","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909","id":"ASB-A-194695497-57a1b923","digest":{"line_hashes":["334199533084626694836244648208521102532","38044901417271632864188770536742574869","173550152809359777534687513766131495902","43544521087176309662915927050405780725","173565680331490800229406522870336291472","41010585180331343088590447053950461077","126675255715789521211312407677343187761","192201047181578796092704105373893608440","281095332955949515334146017962262188685","131005229943685507407948181223533992751","151435939648656856922169056879765873245","293896055190481927883941316866386521470","16789471629837828750971852476416894496","130623704231904072656229607524496604505","57436758362007558008961966365273328498","39157609328686431319111868510179172335","225146397718648864349187310230142139204","316534031332324522471333249097602726138","108093766130535160484837562403598632960","257947357606388693643390694588195234551"],"threshold":0.9},"deprecated":false,"signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909","id":"ASB-A-194695497-b801bb65","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onAttach","file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"digest":{"function_hash":"330485091286897628423529357447139561349","length":542}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909","id":"ASB-A-194695497-de6bae9d","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onPause","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"91963845275780894993294402429917410478","length":153}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909","id":"ASB-A-194695497-f1de905b","deprecated":false,"signature_type":"Line","signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"line_hashes":["239229486420957595956368202128380969072","231064882697015276988132569763951320081","200593779148679881714059040135778176299","87447767317621775843721729129572274897","158832692220761117042415472666228546376","66367091856801011938112290488018410504","241678318852153916596733205425749005796","108124855329909737152417714067839868847","3399581231334601109740174138705536015","208573078307223953797686647032651826796","118990646222525498351112552386115424734","310799688535784630251187413576798147420"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909","id":"ASB-A-194695497-f7de6789","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onResume","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"36740941923910065463964134822007715740","length":260}}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d4e0ed22844c1fbb2afdd2ab9ad8b428e18eb909"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-194695497.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-01-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-01-01","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4","id":"ASB-A-194695497-0d145b0d","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onStart","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"36740941923910065463964134822007715740","length":260}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4","id":"ASB-A-194695497-1723a1e5","target":{"function":"onAttach","file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"signature_type":"Function","signature_version":"v1","deprecated":false,"digest":{"function_hash":"297775876503380350312662350435352403000","length":493}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4","id":"ASB-A-194695497-5e2c8b3f","digest":{"line_hashes":["58186325380940998606572044309683800785","168274576210405597384042247998571296393","53814305264197455281423288812219738337","37713072097084455662303289248028351821","173565680331490800229406522870336291472","41010585180331343088590447053950461077","126675255715789521211312407677343187761","199406920907311450155439362999825324180","145773720459315603110567769967791436740","131005229943685507407948181223533992751","151435939648656856922169056879765873245","293896055190481927883941316866386521470","16789471629837828750971852476416894496","130623704231904072656229607524496604505","57436758362007558008961966365273328498","39157609328686431319111868510179172335","268081101543349386720916255700709436876","200880685560810484905966096075829990905","286617578655076745186620071642771551868","316534031332324522471333249097602726138","252745251783542739927793779143804353331","60654188398131995005716655694692818588"],"threshold":0.9},"deprecated":false,"signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4","id":"ASB-A-194695497-7d238496","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onStop","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"91963845275780894993294402429917410478","length":153}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4","id":"ASB-A-194695497-deb0a403","digest":{"line_hashes":["213947356050651262423463155542306219633","158093438210262513254546451847388399365","165577544182760775379529463281745738425","211678709597058504880002867225384177674","158832692220761117042415472666228546376","66367091856801011938112290488018410504","241678318852153916596733205425749005796","108124855329909737152417714067839868847","3399581231334601109740174138705536015","208573078307223953797686647032651826796","118990646222525498351112552386115424734","310799688535784630251187413576798147420"],"threshold":0.9},"deprecated":false,"signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"signature_type":"Line"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/528d40e4d12bc82bfc48b4c886c177c7b02561a4"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-194695497.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-01-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4","id":"ASB-A-194695497-1463c500","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"onStart","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"function_hash":"36740941923910065463964134822007715740","length":260}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4","id":"ASB-A-194695497-1bb652ed","deprecated":false,"signature_type":"Line","signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"digest":{"line_hashes":["58186325380940998606572044309683800785","168274576210405597384042247998571296393","53814305264197455281423288812219738337","37713072097084455662303289248028351821","173565680331490800229406522870336291472","41010585180331343088590447053950461077","126675255715789521211312407677343187761","199406920907311450155439362999825324180","145773720459315603110567769967791436740","131005229943685507407948181223533992751","151435939648656856922169056879765873245","293896055190481927883941316866386521470","16789471629837828750971852476416894496","130623704231904072656229607524496604505","57436758362007558008961966365273328498","39157609328686431319111868510179172335","268081101543349386720916255700709436876","200880685560810484905966096075829990905","286617578655076745186620071642771551868","316534031332324522471333249097602726138","252745251783542739927793779143804353331","60654188398131995005716655694692818588"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4","id":"ASB-A-194695497-1f738c9f","target":{"function":"onStop","file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"signature_type":"Function","signature_version":"v1","deprecated":false,"digest":{"function_hash":"91963845275780894993294402429917410478","length":153}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4","id":"ASB-A-194695497-272486f8","deprecated":false,"signature_type":"Line","signature_version":"v1","target":{"file":"src/com/android/settings/connecteddevice/DiscoverableFooterPreferenceController.java"},"digest":{"line_hashes":["213947356050651262423463155542306219633","158093438210262513254546451847388399365","165577544182760775379529463281745738425","211678709597058504880002867225384177674","158832692220761117042415472666228546376","66367091856801011938112290488018410504","241678318852153916596733205425749005796","108124855329909737152417714067839868847","3399581231334601109740174138705536015","208573078307223953797686647032651826796","118990646222525498351112552386115424734","310799688535784630251187413576798147420"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4","id":"ASB-A-194695497-2db220c3","deprecated":false,"signature_type":"Function","signature_version":"v1","target":{"function":"onAttach","file":"src/com/android/settings/connecteddevice/ConnectedDeviceDashboardFragment.java"},"digest":{"function_hash":"297775876503380350312662350435352403000","length":493}}],"spl":"2022-01-01","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d7c50f795201fa8dc125a82a711fd7be15b6d3e4"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-194695497.json"}}],"schema_version":"1.7.5"}