{"id":"ASB-A-317203980","details":"In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-317203980","CVE-2025-22437"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/339d20053956ec0f92384f0b7cefda4fa7126290"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"match_only_versions":["15-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["299081490920259318877727632521476767922","302472848972615289292183195072773805259","241865238823797463014263604621323504252","298315331419055250318672200793920101621","147614917347802771605840369520412201880","136949481901407557367519482498560956647","276394434875134967972949936602295470676","95684553906759592070313294543724405523","100404887466980931174629478934732371970","39429240874014650544371897720248906735","261979918624745673946407769660983652040","295816804738498243063969974468879949518","24545805705645075083901089211910123025"],"threshold":0.9},"id":"ASB-A-317203980-11ef2ff3"},{"id":"ASB-A-317203980-39a6ea6d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"function_hash":"325366029875122455442385050112133143490","length":410}},{"digest":{"threshold":0.9,"line_hashes":["236770121537802621648311122075269459875","122654803527651144676053160484220879813","95741851566043158909238225212734541211","241886798512878965046143038112009769442","272603983022526998761392008370444589241","243149956597107806943455836161843096291","106995219572113423590683442444148216646","299958652213519946857433406139940572229","259415800374911855473008150984982785939"]},"id":"ASB-A-317203980-49505b64","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"media/java/android/media/session/MediaSession.java"},"deprecated":false},{"id":"ASB-A-317203980-f4bf587c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4","target":{"file":"media/java/android/media/session/MediaSession.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"function_hash":"8970144000333433291049366764681940003","length":184}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fda5a94aaf91933f8602e00d78ad9ba4872c72f4"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-317203980.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"8970144000333433291049366764681940003","length":184},"id":"ASB-A-317203980-0cf6ff6e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4a1e3f85e00b0b7eba35f70096efe3dbd5287e7f","target":{"function":"setMediaButtonReceiver","file":"media/java/android/media/session/MediaSession.java"},"deprecated":false},{"id":"ASB-A-317203980-33d71905","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4a1e3f85e00b0b7eba35f70096efe3dbd5287e7f","target":{"file":"media/java/android/media/session/MediaSession.java"},"deprecated":false,"digest":{"line_hashes":["236770121537802621648311122075269459875","122654803527651144676053160484220879813","95741851566043158909238225212734541211","243149956597107806943455836161843096291","106995219572113423590683442444148216646","299958652213519946857433406139940572229","259415800374911855473008150984982785939"],"threshold":0.9}},{"id":"ASB-A-317203980-56146558","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4a1e3f85e00b0b7eba35f70096efe3dbd5287e7f","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"setMediaButtonReceiver"},"deprecated":false,"digest":{"length":410,"function_hash":"325366029875122455442385050112133143490"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4a1e3f85e00b0b7eba35f70096efe3dbd5287e7f","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["39429240874014650544371897720248906735","261979918624745673946407769660983652040","295816804738498243063969974468879949518","24545805705645075083901089211910123025"],"threshold":0.9},"id":"ASB-A-317203980-e4561ebe","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4a1e3f85e00b0b7eba35f70096efe3dbd5287e7f"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-317203980.json"}}],"schema_version":"1.9.0"}