{"id":"ASB-A-225880325","details":"In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-225880325","CVE-2023-20971","PUB-A-225880325"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2024-08-01"}]}],"versions":["14-next"],"ecosystem_specific":{"spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"length":552,"function_hash":"175097904346831881255429111086632473640"},"id":"ASB-A-225880325-4639037c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"32121542012993099560012439381062572158","length":561},"id":"ASB-A-225880325-6eff2fcd","match_only_versions":["14-next"],"signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["249589022416497462940867915054438733893","232722225026488737429026988457105817530","205992449486788654372145536191581528691","181461015334851422260102675675321030541"]},"id":"ASB-A-225880325-701b5968","match_only_versions":["14-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"],"threshold":0.9},"id":"ASB-A-225880325-898a1814","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225880325.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-08-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d"],"severity":"High","spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","target":{"function":"removePermission","file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false,"digest":{"function_hash":"30142222829527302351893261236084033085","length":543},"id":"ASB-A-225880325-819faea4"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"225976818360182043641623251115356041903","length":552},"id":"ASB-A-225880325-b599a43c","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"],"threshold":0.9},"id":"ASB-A-225880325-b74ec24b","signature_type":"Line"},{"id":"ASB-A-225880325-fe23d68c","match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["249589022416497462940867915054438733893","232722225026488737429026988457105817530","205992449486788654372145536191581528691","181461015334851422260102675675321030541"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225880325.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-08-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-225880325-05827c8e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"225976818360182043641623251115356041903","length":552}},{"digest":{"length":543,"function_hash":"30142222829527302351893261236084033085"},"id":"ASB-A-225880325-06711be9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","target":{"function":"removePermission","file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"],"threshold":0.9},"id":"ASB-A-225880325-4605766e","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["249589022416497462940867915054438733893","232722225026488737429026988457105817530","205992449486788654372145536191581528691","181461015334851422260102675675321030541"],"threshold":0.9},"id":"ASB-A-225880325-77a6cbcb","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2b5d63b64b2b8208ccc4f62eac3d8962f981dbf8","https://android.googlesource.com/platform/frameworks/base/+/35d77a77feef62dc108f6478cb9228cc6044f70d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225880325.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-08-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"length":561,"function_hash":"32121542012993099560012439381062572158"},"id":"ASB-A-225880325-1e667bbf","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["249589022416497462940867915054438733893","232722225026488737429026988457105817530","205992449486788654372145536191581528691","181461015334851422260102675675321030541"],"threshold":0.9},"id":"ASB-A-225880325-dbb47310","match_only_versions":["13"],"signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"function":"removePermission","file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"175097904346831881255429111086632473640","length":552},"id":"ASB-A-225880325-eb6e1d86","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"],"threshold":0.9},"id":"ASB-A-225880325-fc9eae5d","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1"],"severity":"High","spl":"2024-08-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225880325.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-08-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1"],"severity":"High","spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"175097904346831881255429111086632473640","length":552},"id":"ASB-A-225880325-65b6269d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1"},{"id":"ASB-A-225880325-975db5e5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-225880325.json"}}],"schema_version":"1.9.0"}