{"id":"ASB-A-303408193","details":"In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-303408193","CVE-2025-48588"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/cabbb7da639520633ad318655d1b5fe1c685c78e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cabbb7da639520633ad318655d1b5fe1c685c78e"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-303408193-45118481","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cabbb7da639520633ad318655d1b5fe1c685c78e","target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["308006520857814311227059941594514243447","303259306183604022561936864331572550791","34156594268243472007695419226892102336","292462245565400477376163138737484889527"]}},{"target":{"function":"startAlwaysOnVpn","file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"length":997,"function_hash":"117361317358572158481455682469671708381"},"id":"ASB-A-303408193-7d36def4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cabbb7da639520633ad318655d1b5fe1c685c78e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-303408193.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4a6567e229cdc01d12c91910b68579d42b06fc6d","target":{"function":"startAlwaysOnVpn","file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"length":997,"function_hash":"117361317358572158481455682469671708381"},"id":"ASB-A-303408193-4e84c7ee","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/4a6567e229cdc01d12c91910b68579d42b06fc6d","target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["308006520857814311227059941594514243447","303259306183604022561936864331572550791","34156594268243472007695419226892102336","292462245565400477376163138737484889527"]},"id":"ASB-A-303408193-c0888505","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4a6567e229cdc01d12c91910b68579d42b06fc6d"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-303408193.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"117361317358572158481455682469671708381","length":997},"id":"ASB-A-303408193-b25376b1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/46014fcd29e8e4b36f2ffb5d4e00950c4b3c3eaf","target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java","function":"startAlwaysOnVpn"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/46014fcd29e8e4b36f2ffb5d4e00950c4b3c3eaf","target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["308006520857814311227059941594514243447","303259306183604022561936864331572550791","34156594268243472007695419226892102336","292462245565400477376163138737484889527"]},"id":"ASB-A-303408193-ef42414a"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/46014fcd29e8e4b36f2ffb5d4e00950c4b3c3eaf"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-303408193.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8cd775d41a878e82538681b418fc036bcbbd15db"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/8cd775d41a878e82538681b418fc036bcbbd15db","target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java","function":"startAlwaysOnVpn"},"deprecated":false,"digest":{"function_hash":"117361317358572158481455682469671708381","length":997},"id":"ASB-A-303408193-2884e720","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"},"deprecated":false,"digest":{"line_hashes":["308006520857814311227059941594514243447","303259306183604022561936864331572550791","34156594268243472007695419226892102336","292462245565400477376163138737484889527"],"threshold":0.9},"id":"ASB-A-303408193-7eb7f56a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8cd775d41a878e82538681b418fc036bcbbd15db"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-303408193.json"}}],"schema_version":"1.9.0"}