{"id":"ASB-A-389681530","details":"In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-389681530","CVE-2025-48531"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/0f61e586873a164175543563a1f09f395595b68a"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/70bd3efe0674bccb0d454845d86fb2402779a7bf","target":{"file":"src/com/android/settings/security/CredentialStorage.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69004619432143188435372498649638419146","187524497775067106801693781187058145128","173190076372487040042019352778079133907","181950869077538877837885426374100210392","163365771531368183851379029453875709304","145684537340884886582813187741468596795","336294217071050545271733762124402150535","30699284587307553851089284075018821037","187978009360922205773609323098442394389"]},"id":"ASB-A-389681530-96ebe6d7","signature_type":"Line"},{"digest":{"function_hash":"191379837119476056912526825033863745616","length":803},"id":"ASB-A-389681530-cc3d27c7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/70bd3efe0674bccb0d454845d86fb2402779a7bf","target":{"file":"src/com/android/settings/security/CredentialStorage.java","function":"checkCallerIsCertInstallerOrSelfInProfile"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/70bd3efe0674bccb0d454845d86fb2402779a7bf"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-389681530.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-389681530-1fcfaec0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c7343b33d617a0bdc288030c24a39d8d7a3eb689","target":{"function":"checkCallerIsCertInstallerOrSelfInProfile","file":"src/com/android/settings/security/CredentialStorage.java"},"deprecated":false,"digest":{"length":803,"function_hash":"191379837119476056912526825033863745616"}},{"deprecated":false,"digest":{"line_hashes":["69004619432143188435372498649638419146","187524497775067106801693781187058145128","173190076372487040042019352778079133907","181950869077538877837885426374100210392","163365771531368183851379029453875709304","145684537340884886582813187741468596795","336294217071050545271733762124402150535","30699284587307553851089284075018821037","187978009360922205773609323098442394389"],"threshold":0.9},"id":"ASB-A-389681530-af52d636","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c7343b33d617a0bdc288030c24a39d8d7a3eb689","target":{"file":"src/com/android/settings/security/CredentialStorage.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c7343b33d617a0bdc288030c24a39d8d7a3eb689"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-389681530.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/48e4b5e1af2156dc0db1546df1c14030e77e542e","target":{"file":"src/com/android/settings/security/CredentialStorage.java","function":"checkCallerIsCertInstallerOrSelfInProfile"},"deprecated":false,"digest":{"length":803,"function_hash":"191379837119476056912526825033863745616"},"id":"ASB-A-389681530-52e1a5fa","signature_type":"Function"},{"target":{"file":"src/com/android/settings/security/CredentialStorage.java"},"deprecated":false,"digest":{"line_hashes":["69004619432143188435372498649638419146","187524497775067106801693781187058145128","173190076372487040042019352778079133907","181950869077538877837885426374100210392","163365771531368183851379029453875709304","145684537340884886582813187741468596795","336294217071050545271733762124402150535","30699284587307553851089284075018821037","187978009360922205773609323098442394389"],"threshold":0.9},"id":"ASB-A-389681530-e996b88c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/48e4b5e1af2156dc0db1546df1c14030e77e542e"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/48e4b5e1af2156dc0db1546df1c14030e77e542e"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-389681530.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659","target":{"file":"src/com/android/settings/security/CredentialStorage.java"},"deprecated":false,"digest":{"line_hashes":["69004619432143188435372498649638419146","187524497775067106801693781187058145128","173190076372487040042019352778079133907","181950869077538877837885426374100210392","163365771531368183851379029453875709304","145684537340884886582813187741468596795","336294217071050545271733762124402150535","30699284587307553851089284075018821037","187978009360922205773609323098442394389"],"threshold":0.9},"id":"ASB-A-389681530-1c8c957f","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659","target":{"file":"src/com/android/settings/security/CredentialStorage.java","function":"checkCallerIsCertInstallerOrSelfInProfile"},"deprecated":false,"digest":{"function_hash":"191379837119476056912526825033863745616","length":803},"id":"ASB-A-389681530-a2633383","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-389681530.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-389681530-280c0143","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659","target":{"file":"src/com/android/settings/security/CredentialStorage.java"},"deprecated":false,"digest":{"line_hashes":["69004619432143188435372498649638419146","187524497775067106801693781187058145128","173190076372487040042019352778079133907","181950869077538877837885426374100210392","163365771531368183851379029453875709304","145684537340884886582813187741468596795","336294217071050545271733762124402150535","30699284587307553851089284075018821037","187978009360922205773609323098442394389"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"191379837119476056912526825033863745616","length":803},"id":"ASB-A-389681530-660c6e13","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9cb813172a742781da7a7bbb349429303121b659","target":{"file":"src/com/android/settings/security/CredentialStorage.java","function":"checkCallerIsCertInstallerOrSelfInProfile"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-389681530.json"}}],"schema_version":"1.9.0"}