{"id":"ASB-A-372671447","details":"In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-372671447","CVE-2025-22428"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/4a9cb946e978d9d93f9ee0a2c4c8ca41ba774540"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007","target":{"file":"src/com/android/settings/applications/AppInfoBase.java","function":"hasInteractAcrossUsersFullPermission"},"deprecated":false,"digest":{"length":589,"function_hash":"141402935840275832766109052548010296325"},"id":"ASB-A-372671447-37754fbc","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007","target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"]},"id":"ASB-A-372671447-b4d854c6"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e719575e92c1e6bd0b9088663e6c909bccf2b007"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"id":"ASB-A-372671447-82ec604b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656","target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"141402935840275832766109052548010296325","length":589},"id":"ASB-A-372671447-f8cc6441","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656","target":{"file":"src/com/android/settings/applications/AppInfoBase.java","function":"hasInteractAcrossUsersPermission"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/5bd45baa9365ea8db42249bf83d780c7a0473656"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70","target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"deprecated":false,"digest":{"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"],"threshold":0.9},"id":"ASB-A-372671447-05dc72a7","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-372671447-35a7f6b0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70","target":{"function":"hasInteractAcrossUsersPermission","file":"src/com/android/settings/applications/AppInfoBase.java"},"deprecated":false,"digest":{"function_hash":"141402935840275832766109052548010296325","length":589}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/87645011fc78104372d08b303b361b83e4ce1a70"],"severity":"High","spl":"2025-04-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e","target":{"file":"src/com/android/settings/applications/AppInfoBase.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171121408338032941634247043412481580864","148022555326362211588923513964819100075","42002351314743047139351629358721420425","70407893938082198783244595396619524615","331307535763805289003355655982655001161","43442762450248782866851494676023422739","251260240784935273365111309321917463466","274857719183138919187227466914031626252","1491861563095864626419501710335762412","254822980856664617044708012585451335050","125109871518393969673915034220506927467","123820872093436411091505817552567141969","128129760382388722343904723934348977465","194693192804952070947293174102687088007","243619145025075647397462454710546180774","31664237515638568963709747145360779311","314422190561766948256240878166327586938","270471212009536911983616706385704537974","55178289631961912410907269940270900814","159679927302831788146062976310195559320","333751567642933609218921129979807033804","105135349804760838859480469610730392589","142844325514812842054961022211133550188","209634198631699200840616607459609149003"]},"id":"ASB-A-372671447-60a24b35","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e","target":{"file":"src/com/android/settings/applications/AppInfoBase.java","function":"hasInteractAcrossUsersPermission"},"deprecated":false,"digest":{"length":589,"function_hash":"141402935840275832766109052548010296325"},"id":"ASB-A-372671447-eda6e0c4","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/63656485eaeb51defab1b507f2351cba904c933e"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-372671447.json"}}],"schema_version":"1.9.0"}