{"id":"ASB-A-289809991","details":"In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-289809991","CVE-2023-40130"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79"}],"affected":[{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59","https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["133914857003413315646570965718557078818","315982243663284195210992618241822014595","266328628859364282669968728475815143824","9519643085536760170172263363297085188"]},"id":"ASB-A-289809991-5cef733f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false},{"id":"ASB-A-289809991-923f8518","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"function_hash":"149316474348384160614910124841553593048","length":474}},{"digest":{"length":257,"function_hash":"191252294837772896851767483113381809875"},"id":"ASB-A-289809991-b32ef57f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172429749700010611250441346059781583843","59903213920553620876219754985547236589","212799495587578912626871303567720377655","311277500521534153850202631705000053314"]},"id":"ASB-A-289809991-ff34cb91"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-289809991.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"line_hashes":["172429749700010611250441346059781583843","59903213920553620876219754985547236589","212799495587578912626871303567720377655","311277500521534153850202631705000053314"],"threshold":0.9},"id":"ASB-A-289809991-97a50a6e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451"},{"id":"ASB-A-289809991-a9982ac6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"length":257,"function_hash":"191252294837772896851767483113381809875"}},{"digest":{"function_hash":"149316474348384160614910124841553593048","length":474},"id":"ASB-A-289809991-e10b2ab2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java","function":"notifyTimeout"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"line_hashes":["133914857003413315646570965718557078818","315982243663284195210992618241822014595","266328628859364282669968728475815143824","9519643085536760170172263363297085188"],"threshold":0.9},"id":"ASB-A-289809991-fdbccc0c","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451","https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-289809991.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"function_hash":"149316474348384160614910124841553593048","length":474},"id":"ASB-A-289809991-058e7e1e"},{"target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133914857003413315646570965718557078818","315982243663284195210992618241822014595","266328628859364282669968728475815143824","9519643085536760170172263363297085188"]},"id":"ASB-A-289809991-6306745a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-289809991.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":474,"function_hash":"149316474348384160614910124841553593048"},"id":"ASB-A-289809991-1ee25ee0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"}},{"digest":{"length":257,"function_hash":"191252294837772896851767483113381809875"},"id":"ASB-A-289809991-2d98bdc4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133914857003413315646570965718557078818","315982243663284195210992618241822014595","266328628859364282669968728475815143824","9519643085536760170172263363297085188"]},"id":"ASB-A-289809991-7e165845","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["172429749700010611250441346059781583843","59903213920553620876219754985547236589","212799495587578912626871303567720377655","311277500521534153850202631705000053314"],"threshold":0.9},"id":"ASB-A-289809991-fc703e84","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830","https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-289809991.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-289809991-34758aa2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172429749700010611250441346059781583843","59903213920553620876219754985547236589","212799495587578912626871303567720377655","311277500521534153850202631705000053314"]}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false,"digest":{"line_hashes":["133914857003413315646570965718557078818","315982243663284195210992618241822014595","266328628859364282669968728475815143824","9519643085536760170172263363297085188"],"threshold":0.9},"id":"ASB-A-289809991-418550f6"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9","target":{"file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java","function":"notifyTimeout"},"deprecated":false,"digest":{"length":257,"function_hash":"191252294837772896851767483113381809875"},"id":"ASB-A-289809991-5e23de8a","signature_type":"Function"},{"digest":{"length":474,"function_hash":"149316474348384160614910124841553593048"},"id":"ASB-A-289809991-e2982aaf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2","target":{"function":"notifyTimeout","file":"src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9","https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-289809991.json"}}],"schema_version":"1.9.0"}