{"id":"ASB-A-355411348","details":"In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-355411348","CVE-2024-49720"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Permission/+/e02775c62a81b99ba4cc693dd1885cc70c0bd5cf"}],"affected":[{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"141619514520788998866018257770516533168","length":1623},"id":"ASB-A-355411348-029260a1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/7e1f7097f4a6895358bf1472e6d26c5198d00c11","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java","function":"grantSingleAsUser"},"deprecated":false},{"target":{"function":"isPermissionFixedAsUser","file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java"},"deprecated":false,"digest":{"length":479,"function_hash":"76255136349812465480493960808170142056"},"id":"ASB-A-355411348-0400a4c9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/7e1f7097f4a6895358bf1472e6d26c5198d00c11"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/7e1f7097f4a6895358bf1472e6d26c5198d00c11","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java"},"deprecated":false,"digest":{"line_hashes":["276735937301336299084427692564300228595","322989708559293431295789412320417604874","213152137624597320215320511324637273908","25564878861477671112121177766071587689","262738313968617711989477123477272251866","230377411451346628928423402557176974417","29739341363408189168750249940983237131","61610753031451740195870485119474286831"],"threshold":0.9},"id":"ASB-A-355411348-4adc72b4"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/7e1f7097f4a6895358bf1472e6d26c5198d00c11"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-355411348.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"76255136349812465480493960808170142056","length":479},"id":"ASB-A-355411348-48684712","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/15b296865950d19076a065d8b293d28eae4a3af2","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java","function":"isPermissionFixedAsUser"},"deprecated":false},{"id":"ASB-A-355411348-c1f1bf73","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/15b296865950d19076a065d8b293d28eae4a3af2","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java","function":"grantSingleAsUser"},"deprecated":false,"digest":{"function_hash":"141619514520788998866018257770516533168","length":1623}},{"digest":{"threshold":0.9,"line_hashes":["276735937301336299084427692564300228595","322989708559293431295789412320417604874","213152137624597320215320511324637273908","25564878861477671112121177766071587689","262738313968617711989477123477272251866","230377411451346628928423402557176974417","29739341363408189168750249940983237131","61610753031451740195870485119474286831"]},"id":"ASB-A-355411348-c7359ae3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/15b296865950d19076a065d8b293d28eae4a3af2","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/15b296865950d19076a065d8b293d28eae4a3af2"],"severity":"High","spl":"2025-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-355411348.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"PermissionController/src/com/android/permissioncontroller/role/model/Permissions.java","function":"isPermissionFixed"},"deprecated":false,"digest":{"function_hash":"157246517829887779856954165638462687008","length":447},"id":"ASB-A-355411348-0dd3617f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/71e09e5ad12d02b3129c7a5ce16f6de734fdd0da"},{"target":{"file":"PermissionController/src/com/android/permissioncontroller/role/model/Permissions.java","function":"grantSingle"},"deprecated":false,"digest":{"length":1551,"function_hash":"326735615273034153298670880778922269486"},"id":"ASB-A-355411348-4218609b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/71e09e5ad12d02b3129c7a5ce16f6de734fdd0da"},{"deprecated":false,"digest":{"line_hashes":["276735937301336299084427692564300228595","322989708559293431295789412320417604874","213152137624597320215320511324637273908","71428023426661599606021655487902426771","262738313968617711989477123477272251866","230377411451346628928423402557176974417","29739341363408189168750249940983237131","61610753031451740195870485119474286831"],"threshold":0.9},"id":"ASB-A-355411348-581cb514","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/71e09e5ad12d02b3129c7a5ce16f6de734fdd0da","target":{"file":"PermissionController/src/com/android/permissioncontroller/role/model/Permissions.java"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/71e09e5ad12d02b3129c7a5ce16f6de734fdd0da"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-355411348.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["276735937301336299084427692564300228595","322989708559293431295789412320417604874","213152137624597320215320511324637273908","71428023426661599606021655487902426771","262738313968617711989477123477272251866","230377411451346628928423402557176974417","29739341363408189168750249940983237131","61610753031451740195870485119474286831"],"threshold":0.9},"id":"ASB-A-355411348-1c006cfe","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/04e3f30193b80d0fdb7f68cbe0161dc985aa7557","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/04e3f30193b80d0fdb7f68cbe0161dc985aa7557","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java","function":"grantSingle"},"deprecated":false,"digest":{"function_hash":"326735615273034153298670880778922269486","length":1551},"id":"ASB-A-355411348-82db1744","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/04e3f30193b80d0fdb7f68cbe0161dc985aa7557","target":{"file":"PermissionController/role-controller/java/com/android/role/controller/model/Permissions.java","function":"isPermissionFixed"},"deprecated":false,"digest":{"function_hash":"157246517829887779856954165638462687008","length":447},"id":"ASB-A-355411348-9278377f","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/04e3f30193b80d0fdb7f68cbe0161dc985aa7557"],"severity":"High","spl":"2025-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-355411348.json"}}],"schema_version":"1.9.0"}