{"id":"ASB-A-372671447","details":"In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-372671447","CVE-2025-22428"],"modified":"2026-04-17T15:55:28.020024Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/4a9cb946e978d9d93f9ee0a2c4c8ca41ba774540"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007"],"severity":"High","vanir_signatures":[{"signature_version":"v1","deprecated":false,"target":{"function":"hasInteractAcrossUsersFullPermission","file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Function","id":"ASB-A-372671447-37754fbc","digest":{"function_hash":"141402935840275832766109052548010296325","length":589},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007"},{"signature_version":"v1","deprecated":false,"target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Line","id":"ASB-A-372671447-b4d854c6","digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656"],"severity":"High","vanir_signatures":[{"signature_version":"v1","deprecated":false,"target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Line","id":"ASB-A-372671447-82ec604b","digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656"},{"signature_version":"v1","deprecated":false,"target":{"function":"hasInteractAcrossUsersPermission","file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Function","id":"ASB-A-372671447-f8cc6441","digest":{"function_hash":"141402935840275832766109052548010296325","length":589},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70"],"severity":"High","vanir_signatures":[{"signature_version":"v1","deprecated":false,"target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Line","id":"ASB-A-372671447-05dc72a7","digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70"},{"signature_version":"v1","deprecated":false,"target":{"function":"hasInteractAcrossUsersPermission","file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Function","id":"ASB-A-372671447-35a7f6b0","digest":{"function_hash":"141402935840275832766109052548010296325","length":589},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e"],"severity":"High","vanir_signatures":[{"signature_version":"v1","deprecated":false,"target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Line","id":"ASB-A-372671447-60a24b35","digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e"},{"signature_version":"v1","deprecated":false,"target":{"function":"hasInteractAcrossUsersPermission","file":"src/com/android/settings/applications/AppInfoBase.java"},"signature_type":"Function","id":"ASB-A-372671447-eda6e0c4","digest":{"function_hash":"141402935840275832766109052548010296325","length":589},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}}],"schema_version":"1.7.5"}