{"id":"ASB-A-352542820","details":"In onCreateOptionsMenu of UserSettings.java, there is a possible way to remove the work profile by opening a hidden activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-352542820","CVE-2025-0094"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/c86bccb4e1d3af30e7e89310a3f176091eb497ef"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-02-01"}]}],"versions":["15-next"],"ecosystem_specific":{"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"line_hashes":["242071329039234903564330311102706397438","134295411467839235342482456664948554895","169633955404235269130637314301038315365","56410709368905003823351813560351962084"],"threshold":0.9},"id":"ASB-A-352542820-0f878b2d"},{"id":"ASB-A-352542820-c326fb85","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"digest":{"length":628,"function_hash":"5297040686157113669843507416744298619"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/69c7f5dac580361792bbb189178653b297d06c8a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2025-02-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"],"threshold":0.9},"id":"ASB-A-352542820-333a22bb","signature_type":"Line"},{"digest":{"function_hash":"97534839408003205833569796228337421899","length":637},"id":"ASB-A-352542820-85051e31","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0","target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/44a35ac07bcc076871b8054331096aaff8ee10f0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2025-02-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5"],"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-352542820-2e3df796","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5","target":{"function":"onCreateOptionsMenu","file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"function_hash":"97534839408003205833569796228337421899","length":637}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4901c86b765f5e72075fb5e26374c097920a56f5","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"],"threshold":0.9},"id":"ASB-A-352542820-75666d0d","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-02-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"111839824081433679935569242106740470944","length":600},"id":"ASB-A-352542820-61922730","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862","target":{"function":"onCreateOptionsMenu","file":"src/com/android/settings/users/UserSettings.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"line_hashes":["220850207288900145948609566205506761153","101926054534650046886223476923094117675","180495815931253329562996851526167626856","67827823035145780890074325285873282089"],"threshold":0.9},"id":"ASB-A-352542820-b0ae04f6","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e0b732cbeecb51a26377052501d2b10a8f5ee862"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-02-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/settings/users/UserSettings.java","function":"onCreateOptionsMenu"},"deprecated":false,"digest":{"length":637,"function_hash":"97534839408003205833569796228337421899"},"id":"ASB-A-352542820-521a6e35","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2"},{"target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["123345394078970606313733559622214649680","215436038444051623317548360635020215909","150564406213355045340645040749077914161","297603582668471109437827171691432367717","210570433010057915318453600932896554013"]},"id":"ASB-A-352542820-cc2f3f5e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/31e69deb2809887b5ea7b8b7a7893d7db90acdd2"],"severity":"High","spl":"2025-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-02-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f","target":{"function":"onCreateOptionsMenu","file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"function_hash":"111839824081433679935569242106740470944","length":600},"id":"ASB-A-352542820-3fb7d2f1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f","target":{"file":"src/com/android/settings/users/UserSettings.java"},"deprecated":false,"digest":{"line_hashes":["220850207288900145948609566205506761153","101926054534650046886223476923094117675","180495815931253329562996851526167626856","67827823035145780890074325285873282089"],"threshold":0.9},"id":"ASB-A-352542820-c2231d48"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6e413c4cff2f306d18e9682b1e0be5ddc8427c5f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352542820.json"}}],"schema_version":"1.9.0"}