{"id":"ASB-A-278558814","details":"In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-278558814","CVE-2023-40106"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2023-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/442b4390c1f04b0e74ae4a7e349418dad4e7522e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-11-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"length":525,"function_hash":"299885229804771728740092935875043806001"},"id":"ASB-A-278558814-39eea5ef","match_only_versions":["11"]},{"deprecated":false,"digest":{"line_hashes":["19328514911481988449621301501520510512","128180843045622298964632623511621361173","74689441452148401004442135179706795859","77537239920818797693030053119675326142","60413899272237561873938372037301081054"],"threshold":0.9},"id":"ASB-A-278558814-4b542da9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","target":{"file":"core/java/android/app/Notification.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"deprecated":false,"digest":{"function_hash":"252082531642471137095806740854698228715","length":71},"id":"ASB-A-278558814-95b67700"},{"digest":{"threshold":0.9,"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"]},"id":"ASB-A-278558814-f5fa0cbc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac"],"severity":"High","spl":"2023-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-11-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"function_hash":"275372314725821542637644716462634945986","length":71},"id":"ASB-A-278558814-0138cc1a","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true,"digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"id":"ASB-A-278558814-22b24c29"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"sanitizeSbn"},"deprecated":true,"digest":{"length":525,"function_hash":"299885229804771728740092935875043806001"},"id":"ASB-A-278558814-d5606d2f","match_only_versions":["12"],"signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"]},"id":"ASB-A-278558814-fcfa0715","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"file":"core/java/android/app/Notification.java"},"deprecated":true}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-11-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":true,"digest":{"threshold":0.9,"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"]},"id":"ASB-A-278558814-912fd3e1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}},{"id":"ASB-A-278558814-d3c1ddb1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"length":71,"function_hash":"275372314725821542637644716462634945986"}},{"digest":{"length":525,"function_hash":"299885229804771728740092935875043806001"},"id":"ASB-A-278558814-e6f926f7","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","target":{"file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"threshold":0.9,"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"]},"id":"ASB-A-278558814-efee8be2","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6"],"severity":"High","spl":"2023-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-11-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"length":71,"function_hash":"275372314725821542637644716462634945986"},"id":"ASB-A-278558814-236d8e8f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true,"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"id":"ASB-A-278558814-392d2632","match_only_versions":["13"],"signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","target":{"file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"threshold":0.9,"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"]},"id":"ASB-A-278558814-4f1a7aa4","signature_type":"Line"},{"digest":{"threshold":0.9,"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"]},"id":"ASB-A-278558814-b4b30738","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true,"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"id":"ASB-A-278558814-02aae8ef","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":true,"digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"id":"ASB-A-278558814-a63fabec","signature_type":"Line"},{"digest":{"length":71,"function_hash":"275372314725821542637644716462634945986"},"id":"ASB-A-278558814-e8d9c695","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","target":{"file":"core/java/android/app/Notification.java","function":"setAllowlistToken"},"deprecated":true},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","target":{"file":"core/java/android/app/Notification.java"},"deprecated":true,"digest":{"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"],"threshold":0.9},"id":"ASB-A-278558814-f875368b","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}}],"schema_version":"1.9.0"}