{"id":"ASB-A-237766679","details":"In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-237766679","CVE-2023-21089"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/2d20bee73d9ba1c56d49041991e141ba3fe68c5a"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2023-04-01"}]}],"versions":["13-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-237766679-09b2d3b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f94e4d8e90c1a1a8655f5384f3d0c428951394ab","target":{"function":"computeOomAdjLSP","file":"services/core/java/com/android/server/am/OomAdjuster.java"},"deprecated":false,"digest":{"length":25366,"function_hash":"261020442301623220239914373066621812035"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/62ae15335bfa14dbd583d1c2019f36641b3c4499","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false,"digest":{"length":5148,"function_hash":"55033611091652766663857133286467096158"},"id":"ASB-A-237766679-16eb4946"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6e7343756f510c878e53390ea82e5936b9c16d8","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false,"digest":{"length":4749,"function_hash":"206213621436195695622861945275215263056"},"id":"ASB-A-237766679-1fc4fe89"},{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["221500824581219247607752389478836657194","118279720554820571106150299873347108622","40195339095343540601852591297555666659"],"threshold":0.9},"id":"ASB-A-237766679-363909f0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6e7343756f510c878e53390ea82e5936b9c16d8"},{"target":{"file":"services/core/java/com/android/server/am/OomAdjuster.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45889193571489898754819745180116740064","70702682889017062139098948842835486377","267199326354569661533549059921738953475","200287827859909492878455974803737000756","267111193992151164575056732187146505684","332033889706154271432119019970091783478","222175889293983889667074114548989413470","191110265533759971874479373160948460335","237667255917591614263557675223062402043","107116551869015075857457756111706581275","61560613532054584590974819742675667442","158156078762079022636955624147697876163","253220886344515708705307981034335389620","329332243181098572111806462661608454272","36903783319038985313026662082323835466"]},"id":"ASB-A-237766679-62bc51a2","match_only_versions":["13-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f94e4d8e90c1a1a8655f5384f3d0c428951394ab"},{"target":{"file":"services/core/java/com/android/server/am/OomAdjuster.java","function":"getDefaultCapability"},"deprecated":false,"digest":{"length":572,"function_hash":"23350080238570695405701213665260073628"},"id":"ASB-A-237766679-9695f2de","match_only_versions":["13-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f94e4d8e90c1a1a8655f5384f3d0c428951394ab"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea3970887683fb18a8180b425cc14102396ee00d","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["218036373952006876221110023763965589871","299253713187424794531056651888714146308","85061882957808510653676117443229045952","212408163724467335781474175824142850888","267369423550567621523901784619241603605","112443739984359875282097783791166002396","227485280610046146846688214189189994033"]},"id":"ASB-A-237766679-bb81adde","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/62ae15335bfa14dbd583d1c2019f36641b3c4499","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["150879188847474757560318238790429682883","142039121869990323743579952558519169917","64849485139039774888461575041385499202","132939419264760486351231394269320697673","217783203505312328417466856074347879793","169649374847203213844078397754522319299","85079607111811584042688613235238941797","30533370187811226254822331023787014222"],"threshold":0.9},"id":"ASB-A-237766679-cb62f29e","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"21059591443163205247196022420001902244","length":5098},"id":"ASB-A-237766679-eac37bc9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea3970887683fb18a8180b425cc14102396ee00d","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6e7343756f510c878e53390ea82e5936b9c16d8","https://android.googlesource.com/platform/frameworks/base/+/ea3970887683fb18a8180b425cc14102396ee00d","https://android.googlesource.com/platform/frameworks/base/+/f94e4d8e90c1a1a8655f5384f3d0c428951394ab","https://android.googlesource.com/platform/frameworks/base/+/62ae15335bfa14dbd583d1c2019f36641b3c4499"],"severity":"High","spl":"2023-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-237766679.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-04-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2023-04-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/8c90891a38ecb5047e115e13baf700a8b486a5d1","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false,"digest":{"function_hash":"21034421742601590535636389842059003527","length":3662},"id":"ASB-A-237766679-6a18fac1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8c90891a38ecb5047e115e13baf700a8b486a5d1","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["269684630138826889625859826550126767224","148589413550345063463726362386917874073","21567323259179004115643900225378340917","137251914390210945334163069411398562491","203661793217582079446986351059899764163","28540091405360853314795402805562118117","223857493236704816819547189416167560002"],"threshold":0.9},"id":"ASB-A-237766679-c048aaa9","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8c90891a38ecb5047e115e13baf700a8b486a5d1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-237766679.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-04-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"274217139864186057789111519119916908032","length":4175},"id":"ASB-A-237766679-290486c8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5985225e777cdb96b738aeda859dff49f6c6f853","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false},{"id":"ASB-A-237766679-b264aa6d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5985225e777cdb96b738aeda859dff49f6c6f853","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["321739464313689101190173871621246585312","256800668022919934400417933160505713047","270673493866831921931363097009780579345","137251914390210945334163069411398562491","68318016864582298944874182767418455091","176628759993620618274370284065506164893","223857493236704816819547189416167560002"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5985225e777cdb96b738aeda859dff49f6c6f853"],"severity":"High","spl":"2023-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-237766679.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-04-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/74b6e62aedd9bcf081a4571706ce2856bb300edc","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["321739464313689101190173871621246585312","256800668022919934400417933160505713047","270673493866831921931363097009780579345","137251914390210945334163069411398562491","68318016864582298944874182767418455091","176628759993620618274370284065506164893","223857493236704816819547189416167560002"]},"id":"ASB-A-237766679-103ba806","signature_type":"Line"},{"digest":{"function_hash":"307188632679855613478063177906811698236","length":4597},"id":"ASB-A-237766679-121b0db2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/74b6e62aedd9bcf081a4571706ce2856bb300edc","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/74b6e62aedd9bcf081a4571706ce2856bb300edc"],"severity":"High","spl":"2023-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-237766679.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-04-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-04-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0bf31e3efc914b32817bfae8a602d8d5816bf70a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["321739464313689101190173871621246585312","221500824581219247607752389478836657194","118279720554820571106150299873347108622","40195339095343540601852591297555666659","68318016864582298944874182767418455091","176628759993620618274370284065506164893","223857493236704816819547189416167560002"],"threshold":0.9},"id":"ASB-A-237766679-7f830e44"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0bf31e3efc914b32817bfae8a602d8d5816bf70a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"startInstrumentation"},"deprecated":false,"digest":{"function_hash":"212383207345680878901144950132060932017","length":4737},"id":"ASB-A-237766679-f99c4653"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0bf31e3efc914b32817bfae8a602d8d5816bf70a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-237766679.json"}}],"schema_version":"1.9.0"}