{"id":"ASB-A-352542820","details":"In onCreateOptionsMenu of UserSettings.java, there is a possible way to remove the work profile by opening a hidden activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-352542820","CVE-2025-0094"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2025-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/c86bccb4e1d3af30e7e89310a3f176091eb497ef"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-02-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a","id":"ASB-A-352542820-0f878b2d","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["242071329039234903564330311102706397438","134295411467839235342482456664948554895","169633955404235269130637314301038315365","56410709368905003823351813560351962084"]},"signature_version":"v1"},{"signature_version":"v1","id":"ASB-A-352542820-c326fb85","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":628,"function_hash":"5297040686157113669843507416744298619"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2025-02-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0","signature_version":"v1","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"]},"id":"ASB-A-352542820-333a22bb"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":637,"function_hash":"97534839408003205833569796228337421899"},"id":"ASB-A-352542820-85051e31"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2025-02-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5"],"vanir_signatures":[{"signature_version":"v1","id":"ASB-A-352542820-2e3df796","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":637,"function_hash":"97534839408003205833569796228337421899"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5"},{"signature_version":"v1","id":"ASB-A-352542820-75666d0d","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"]},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-02-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862","signature_version":"v1","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":600,"function_hash":"111839824081433679935569242106740470944"},"id":"ASB-A-352542820-61922730"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862","signature_version":"v1","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["220850207288900145948609566205506761153","101926054534650046886223476923094117675","180495815931253329562996851526167626856","67827823035145780890074325285873282089"]},"id":"ASB-A-352542820-b0ae04f6"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-02-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2","id":"ASB-A-352542820-521a6e35","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":637,"function_hash":"97534839408003205833569796228337421899"},"signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2","signature_version":"v1","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"]},"id":"ASB-A-352542820-cc2f3f5e"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-02-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f"],"vanir_signatures":[{"signature_version":"v1","id":"ASB-A-352542820-3fb7d2f1","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"signature_type":"Function","digest":{"length":600,"function_hash":"111839824081433679935569242106740470944"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["220850207288900145948609566205506761153","101926054534650046886223476923094117675","180495815931253329562996851526167626856","67827823035145780890074325285873282089"]},"id":"ASB-A-352542820-c2231d48"}],"severity":"High","spl":"2025-02-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}}],"schema_version":"1.7.5"}