{"id":"ASB-A-278558814","details":"In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-278558814","CVE-2023-40106"],"modified":"2026-05-25T16:46:24.913870386Z","published":"2023-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/442b4390c1f04b0e74ae4a7e349418dad4e7522e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-11-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"spl":"2023-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac"],"vanir_signatures":[{"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"signature_type":"Function","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"match_only_versions":["11"],"id":"ASB-A-278558814-39eea5ef","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","signature_version":"v1"},{"id":"ASB-A-278558814-4b542da9","digest":{"line_hashes":["19328514911481988449621301501520510512","128180843045622298964632623511621361173","74689441452148401004442135179706795859","77537239920818797693030053119675326142","60413899272237561873938372037301081054"],"threshold":0.9},"deprecated":false,"signature_version":"v1","target":{"file":"core/java/android/app/Notification.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","signature_type":"Line"},{"id":"ASB-A-278558814-95b67700","digest":{"function_hash":"252082531642471137095806740854698228715","length":71},"deprecated":false,"signature_version":"v1","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","signature_type":"Function"},{"id":"ASB-A-278558814-f5fa0cbc","digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/75fcbb37617246c43c2af34b12c9ae4b4043f9ac","signature_version":"v1","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"signature_type":"Line","deprecated":false}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-11-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"spl":"2023-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6"],"vanir_signatures":[{"id":"ASB-A-278558814-0138cc1a","digest":{"function_hash":"275372314725821542637644716462634945986","length":71},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1","signature_type":"Function","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"deprecated":true},{"id":"ASB-A-278558814-22b24c29","digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"signature_type":"Line","deprecated":true},{"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"signature_type":"Function","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"match_only_versions":["12"],"id":"ASB-A-278558814-d5606d2f","deprecated":true,"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1"},{"id":"ASB-A-278558814-fcfa0715","digest":{"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1","target":{"file":"core/java/android/app/Notification.java"},"signature_type":"Line","deprecated":true}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-11-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"spl":"2023-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6"],"vanir_signatures":[{"id":"ASB-A-278558814-912fd3e1","digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1","signature_type":"Line","deprecated":true,"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}},{"id":"ASB-A-278558814-d3c1ddb1","digest":{"function_hash":"275372314725821542637644716462634945986","length":71},"deprecated":true,"signature_version":"v1","signature_type":"Function","target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6"},{"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"signature_type":"Function","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"match_only_versions":["12L"],"id":"ASB-A-278558814-e6f926f7","source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","deprecated":true,"signature_version":"v1"},{"id":"ASB-A-278558814-efee8be2","digest":{"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8d839e4985d0acc662e1019390c88fab20bacbd6","signature_version":"v1","signature_type":"Line","deprecated":true,"target":{"file":"core/java/android/app/Notification.java"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-11-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"spl":"2023-11-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706"],"vanir_signatures":[{"id":"ASB-A-278558814-236d8e8f","digest":{"function_hash":"275372314725821542637644716462634945986","length":71},"source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","signature_version":"v1","signature_type":"Function","deprecated":true,"target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"}},{"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"signature_type":"Function","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"match_only_versions":["13"],"id":"ASB-A-278558814-392d2632","source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","deprecated":true,"signature_version":"v1"},{"id":"ASB-A-278558814-4f1a7aa4","digest":{"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","signature_version":"v1","signature_type":"Line","deprecated":true,"target":{"file":"core/java/android/app/Notification.java"}},{"id":"ASB-A-278558814-b4b30738","digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/1896c2e7068c9ec1ab8355d863d7e8107d5d5706","signature_version":"v1","signature_type":"Line","deprecated":true,"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"299885229804771728740092935875043806001","length":525},"signature_type":"Function","target":{"function":"sanitizeSbn","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"match_only_versions":["14"],"id":"ASB-A-278558814-02aae8ef","source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","deprecated":true,"signature_version":"v1"},{"id":"ASB-A-278558814-a63fabec","digest":{"line_hashes":["171548852846172734744435483104381182718","222376968769515075791879262325112236898","15274997982046198563146298409434740710","294096154273122677522205917725905343301"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","signature_version":"v1","signature_type":"Line","deprecated":true,"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}},{"id":"ASB-A-278558814-e8d9c695","digest":{"function_hash":"275372314725821542637644716462634945986","length":71},"source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f","signature_version":"v1","signature_type":"Function","deprecated":true,"target":{"function":"setAllowlistToken","file":"core/java/android/app/Notification.java"}},{"id":"ASB-A-278558814-f875368b","digest":{"line_hashes":["19328514911481988449621301501520510512","264348577362792108663720183346652756510","258169763999396838387685599658587282028","208883902105813895585599267926983689348","271312454085563944599205919785273639862"],"threshold":0.9},"deprecated":true,"signature_version":"v1","signature_type":"Line","target":{"file":"core/java/android/app/Notification.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e79cbff7f85ea5497dcdb27b13535e4e3ac9913f"],"spl":"2023-11-01","severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-278558814.json"}}],"schema_version":"1.7.5"}