{"id":"ASB-A-232798676","details":"In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-232798676","CVE-2023-21351"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-08-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"line_hashes":["93299813471410581969135562935949905153","15472191267997321310275476709132526577","331422874673880489244790870663492104578","33723722171494134271822092619579944937"],"threshold":0.9},"id":"ASB-A-232798676-1796cf58"},{"digest":{"line_hashes":["144008831271877775662079963192363386019","149565855102874764223428405739804773110","286166597539931852017663930028381477354","262188004735850955989416676751414883186"],"threshold":0.9},"id":"ASB-A-232798676-29945343","match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"},"deprecated":false},{"digest":{"function_hash":"225525040755863857645690462741476020974","length":3964},"id":"ASB-A-232798676-33b75457","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java","function":"executeRunnableJob"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/content/SyncManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259235494500818370210906025499202764482","34136816839363062996480202865251043571","696580132731913356371448635277988861","21853837409063633111980745404740668238"]},"id":"ASB-A-232798676-4ad963f4","match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247"},{"target":{"file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"},"deprecated":false,"digest":{"line_hashes":["74455769762697750460255520584522158894","132646460571437456104781522575404255177","8905393033166037666809215070796674938","158161077941656787118329839392027690945"],"threshold":0.9},"id":"ASB-A-232798676-62b99756","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247"},{"deprecated":false,"digest":{"line_hashes":["116626284343495268760957425476925002581","330980504914148740360309973183815087622","241767685514125665930956329372421081087","45926270977031310712186060351056412196","334425237711487289252441300952835309751","206724839735444028784137070382871675147","165827097755485229730906960766601865145","1449853733044119338181027052016044817"],"threshold":0.9},"id":"ASB-A-232798676-6801a1f8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"}},{"match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"core/java/android/speech/tts/TextToSpeech.java"},"deprecated":false,"digest":{"line_hashes":["24864871434105128454340282503419934828","121243039367796971847175383063378041363","314498299160822359260625223032540822833","257354329809624862529202622426370759138"],"threshold":0.9},"id":"ASB-A-232798676-6a97dcf1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"bind","file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"},"deprecated":false,"digest":{"length":551,"function_hash":"248991916340014374648342699255386558168"},"id":"ASB-A-232798676-708d342a","match_only_versions":["12"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"ensureBound","file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"function_hash":"284769961671316759783773943984793267599","length":583},"id":"ASB-A-232798676-8b1ae50d","match_only_versions":["12"],"signature_type":"Function","signature_version":"v1"},{"digest":{"length":389,"function_hash":"8532100015852247629726694262108351871"},"id":"ASB-A-232798676-c5d1a13e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"TextToSpeechSessionConnection","file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"connect","file":"core/java/android/speech/tts/TextToSpeech.java"},"deprecated":false,"digest":{"function_hash":"178154694252623401895496722196873171179","length":197},"id":"ASB-A-232798676-cef6bff5","match_only_versions":["12"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232798676.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-08-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247"],"severity":"High","spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["93299813471410581969135562935949905153","15472191267997321310275476709132526577","331422874673880489244790870663492104578","33723722171494134271822092619579944937"]},"id":"ASB-A-232798676-029c9436","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"}},{"target":{"file":"core/java/android/speech/tts/TextToSpeech.java"},"deprecated":false,"digest":{"line_hashes":["24864871434105128454340282503419934828","121243039367796971847175383063378041363","314498299160822359260625223032540822833","257354329809624862529202622426370759138"],"threshold":0.9},"id":"ASB-A-232798676-0e1fb62f","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"},"deprecated":false,"digest":{"line_hashes":["74455769762697750460255520584522158894","132646460571437456104781522575404255177","8905393033166037666809215070796674938","158161077941656787118329839392027690945"],"threshold":0.9},"id":"ASB-A-232798676-33cefc11"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java","function":"bind"},"deprecated":false,"digest":{"length":551,"function_hash":"248991916340014374648342699255386558168"},"id":"ASB-A-232798676-421815ca","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"178154694252623401895496722196873171179","length":197},"id":"ASB-A-232798676-49a6b0ba","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"connect","file":"core/java/android/speech/tts/TextToSpeech.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["259235494500818370210906025499202764482","34136816839363062996480202865251043571","696580132731913356371448635277988861","21853837409063633111980745404740668238"]},"id":"ASB-A-232798676-5a67f06b","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/core/java/com/android/server/content/SyncManager.java"},"deprecated":false},{"digest":{"line_hashes":["116626284343495268760957425476925002581","330980504914148740360309973183815087622","241767685514125665930956329372421081087","45926270977031310712186060351056412196","334425237711487289252441300952835309751","206724839735444028784137070382871675147","165827097755485229730906960766601865145","1449853733044119338181027052016044817"],"threshold":0.9},"id":"ASB-A-232798676-85ddf793","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"},"deprecated":false},{"deprecated":false,"digest":{"length":389,"function_hash":"8532100015852247629726694262108351871"},"id":"ASB-A-232798676-b269bc6f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java","function":"TextToSpeechSessionConnection"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java","function":"executeRunnableJob"},"deprecated":false,"digest":{"length":3964,"function_hash":"225525040755863857645690462741476020974"},"id":"ASB-A-232798676-b83e105d"},{"deprecated":false,"digest":{"function_hash":"284769961671316759783773943984793267599","length":583},"id":"ASB-A-232798676-db1e3d88","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"function":"ensureBound","file":"services/print/java/com/android/server/print/RemotePrintService.java"}},{"match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8fdf4a345e140eba9b4e736d24ab95c67c55a247","target":{"file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144008831271877775662079963192363386019","149565855102874764223428405739804773110","286166597539931852017663930028381477354","262188004735850955989416676751414883186"]},"id":"ASB-A-232798676-f30fb37d"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232798676.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-08-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2024-08-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"core/java/android/speech/tts/TextToSpeech.java","function":"connect"},"deprecated":false,"digest":{"function_hash":"178154694252623401895496722196873171179","length":197},"id":"ASB-A-232798676-208363c1","match_only_versions":["13"]},{"digest":{"length":389,"function_hash":"8532100015852247629726694262108351871"},"id":"ASB-A-232798676-3d91c157","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"function":"TextToSpeechSessionConnection","file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java","function":"bind"},"deprecated":false,"digest":{"function_hash":"248991916340014374648342699255386558168","length":551},"id":"ASB-A-232798676-5183b9f0","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java","function":"ensureBound"},"deprecated":false,"digest":{"length":583,"function_hash":"284769961671316759783773943984793267599"},"id":"ASB-A-232798676-6d50c3a5","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["116626284343495268760957425476925002581","330980504914148740360309973183815087622","241767685514125665930956329372421081087","45926270977031310712186060351056412196","334425237711487289252441300952835309751","206724839735444028784137070382871675147","165827097755485229730906960766601865145","1449853733044119338181027052016044817"]},"id":"ASB-A-232798676-87834177","signature_type":"Line"},{"match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"services/core/java/com/android/server/content/SyncManager.java"},"deprecated":false,"digest":{"line_hashes":["259235494500818370210906025499202764482","34136816839363062996480202865251043571","696580132731913356371448635277988861","21853837409063633111980745404740668238"],"threshold":0.9},"id":"ASB-A-232798676-9f407e00"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"services/core/java/com/android/server/media/MediaRoute2ProviderServiceProxy.java"},"deprecated":false,"digest":{"line_hashes":["144008831271877775662079963192363386019","149565855102874764223428405739804773110","286166597539931852017663930028381477354","262188004735850955989416676751414883186"],"threshold":0.9},"id":"ASB-A-232798676-adb81d15","match_only_versions":["13"]},{"deprecated":false,"digest":{"line_hashes":["74455769762697750460255520584522158894","132646460571437456104781522575404255177","8905393033166037666809215070796674938","158161077941656787118329839392027690945"],"threshold":0.9},"id":"ASB-A-232798676-c468db21","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"services/texttospeech/java/com/android/server/texttospeech/TextToSpeechManagerPerUserService.java"}},{"digest":{"function_hash":"219087430509146042353024614449936686070","length":4517},"id":"ASB-A-232798676-cdf51366","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"function":"executeRunnableJob","file":"apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java"},"deprecated":false},{"id":"ASB-A-232798676-d71db2d2","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82","target":{"file":"core/java/android/speech/tts/TextToSpeech.java"},"deprecated":false,"digest":{"line_hashes":["24864871434105128454340282503419934828","121243039367796971847175383063378041363","314498299160822359260625223032540822833","257354329809624862529202622426370759138"],"threshold":0.9}},{"target":{"file":"services/print/java/com/android/server/print/RemotePrintService.java"},"deprecated":false,"digest":{"line_hashes":["93299813471410581969135562935949905153","15472191267997321310275476709132526577","331422874673880489244790870663492104578","33723722171494134271822092619579944937"],"threshold":0.9},"id":"ASB-A-232798676-e3df108e","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/95b71ad87dc24cd7d3ad91172aa2a9e16c19fb82"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232798676.json"}}],"schema_version":"1.9.0"}