{"id":"ASB-A-272024837","details":"In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-272024837","CVE-2023-40111"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/55d3d57cbffc838c52d610af14a056dea87b422e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2023-11-01"}]}],"versions":["14-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"media/java/android/media/session/MediaSession.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["236770121537802621648311122075269459875","122654803527651144676053160484220879813","95741851566043158909238225212734541211","241886798512878965046143038112009769442","272603983022526998761392008370444589241","243149956597107806943455836161843096291","106995219572113423590683442444148216646","299958652213519946857433406139940572229","259415800374911855473008150984982785939"]},"id":"ASB-A-272024837-5cf0e1e6","match_only_versions":["14-next"],"signature_type":"Line"},{"id":"ASB-A-272024837-b21b403f","match_only_versions":["14-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["299081490920259318877727632521476767922","302472848972615289292183195072773805259","241865238823797463014263604621323504252","298315331419055250318672200793920101621","147614917347802771605840369520412201880","136949481901407557367519482498560956647","276394434875134967972949936602295470676","95684553906759592070313294543724405523","100404887466980931174629478934732371970","39429240874014650544371897720248906735","261979918624745673946407769660983652040","295816804738498243063969974468879949518","24545805705645075083901089211910123025"]}},{"digest":{"function_hash":"325366029875122455442385050112133143490","length":410},"id":"ASB-A-272024837-cf048780","match_only_versions":["14-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"setMediaButtonReceiver"},"deprecated":false},{"id":"ASB-A-272024837-e2c09b8c","match_only_versions":["14-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"media/java/android/media/session/MediaSession.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"function_hash":"8970144000333433291049366764681940003","length":184}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4"],"severity":"High","spl":"2023-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-272024837.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/d455e21711c167223f7d0696809a4e411683182c","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["39429240874014650544371897720248906735","261979918624745673946407769660983652040","295816804738498243063969974468879949518","24545805705645075083901089211910123025"],"threshold":0.9},"id":"ASB-A-272024837-20b9b59d","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"function_hash":"325366029875122455442385050112133143490","length":410},"id":"ASB-A-272024837-25eaa2bb","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d455e21711c167223f7d0696809a4e411683182c"},{"match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d455e21711c167223f7d0696809a4e411683182c","target":{"file":"media/java/android/media/session/MediaSession.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"function_hash":"8970144000333433291049366764681940003","length":184},"id":"ASB-A-272024837-4be61c7a"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["236770121537802621648311122075269459875","122654803527651144676053160484220879813","95741851566043158909238225212734541211","243149956597107806943455836161843096291","106995219572113423590683442444148216646","299958652213519946857433406139940572229","259415800374911855473008150984982785939"]},"id":"ASB-A-272024837-71b62f18","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d455e21711c167223f7d0696809a4e411683182c","target":{"file":"media/java/android/media/session/MediaSession.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d455e21711c167223f7d0696809a4e411683182c"],"severity":"High","spl":"2023-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-272024837.json"}}],"schema_version":"1.9.0"}