{"id":"ASB-A-401256328","details":"In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-401256328","CVE-2025-48550"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/bae8ab23b03d57b4e9a7c24eb087d058faf7fa73"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"157130551415955598566352797403227380524","length":218},"id":"ASB-A-401256328-055ef97e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5f0874dde8c0572e078ebb9d74d8f891e3103175","target":{"function":"PkgUser","file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5f0874dde8c0572e078ebb9d74d8f891e3103175","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"},"deprecated":false,"digest":{"function_hash":"240764946324075854173994847004737990322","length":75},"id":"ASB-A-401256328-31dce72c"},{"target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200022116920192794837966910784835980386","57233620267693891124038157513111778797","333953230270992963311973259353359410477","324316816806016295360820776409309305563","93911001127874547445709805665773492397","139802966142082393163616442078014969","12262675147559931215374000589747710487","190420132181656345981628327849512467352","192317175273104458627111905836037941753","17689362358359657338713834903592578519","93194188375933297925873444413804359157","245256544450743878772069354856791681272","305510806987019648453778953207025737555","221144551137298854800971737185443471085","315102600677669206119257331320538597303","112433762888012341279837149390968255568"]},"id":"ASB-A-401256328-4ccfc030","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5f0874dde8c0572e078ebb9d74d8f891e3103175"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5f0874dde8c0572e078ebb9d74d8f891e3103175"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401256328.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"id":"ASB-A-401256328-0106bd1c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53c79b8cd60ff42717f9da3f85b5a576c1d56833","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"line_hashes":["200022116920192794837966910784835980386","57233620267693891124038157513111778797","333953230270992963311973259353359410477","324316816806016295360820776409309305563","93911001127874547445709805665773492397","139802966142082393163616442078014969","12262675147559931215374000589747710487","190420132181656345981628327849512467352","192317175273104458627111905836037941753","17689362358359657338713834903592578519","93194188375933297925873444413804359157","245256544450743878772069354856791681272","305510806987019648453778953207025737555","221144551137298854800971737185443471085","315102600677669206119257331320538597303","112433762888012341279837149390968255568"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53c79b8cd60ff42717f9da3f85b5a576c1d56833","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"},"deprecated":false,"digest":{"function_hash":"240764946324075854173994847004737990322","length":75},"id":"ASB-A-401256328-37d59b09"},{"deprecated":false,"digest":{"function_hash":"157130551415955598566352797403227380524","length":218},"id":"ASB-A-401256328-5ab232f0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53c79b8cd60ff42717f9da3f85b5a576c1d56833","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53c79b8cd60ff42717f9da3f85b5a576c1d56833"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401256328.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":218,"function_hash":"157130551415955598566352797403227380524"},"id":"ASB-A-401256328-c3f4df4c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53dc72fedf79f8af1e66be737bc81dac4967645d","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"line_hashes":["200022116920192794837966910784835980386","57233620267693891124038157513111778797","333953230270992963311973259353359410477","324316816806016295360820776409309305563","93911001127874547445709805665773492397","139802966142082393163616442078014969","12262675147559931215374000589747710487","190420132181656345981628327849512467352","192317175273104458627111905836037941753","17689362358359657338713834903592578519","93194188375933297925873444413804359157","245256544450743878772069354856791681272","305510806987019648453778953207025737555","221144551137298854800971737185443471085","315102600677669206119257331320538597303","112433762888012341279837149390968255568"],"threshold":0.9},"id":"ASB-A-401256328-c6cc3d9a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53dc72fedf79f8af1e66be737bc81dac4967645d"},{"target":{"function":"PkgUser","file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"function_hash":"240764946324075854173994847004737990322","length":75},"id":"ASB-A-401256328-d2ad1922","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53dc72fedf79f8af1e66be737bc81dac4967645d"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53dc72fedf79f8af1e66be737bc81dac4967645d"],"severity":"High","spl":"2025-09-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401256328.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"},"deprecated":false,"digest":{"function_hash":"240764946324075854173994847004737990322","length":75},"id":"ASB-A-401256328-50bfe42f","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["200022116920192794837966910784835980386","57233620267693891124038157513111778797","333953230270992963311973259353359410477","324316816806016295360820776409309305563","93911001127874547445709805665773492397","139802966142082393163616442078014969","12262675147559931215374000589747710487","190420132181656345981628327849512467352","192317175273104458627111905836037941753","17689362358359657338713834903592578519","93194188375933297925873444413804359157","245256544450743878772069354856791681272","305510806987019648453778953207025737555","221144551137298854800971737185443471085","315102600677669206119257331320538597303","112433762888012341279837149390968255568"],"threshold":0.9},"id":"ASB-A-401256328-63aded2e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java","function":"PkgUser"},"deprecated":false,"digest":{"length":218,"function_hash":"157130551415955598566352797403227380524"},"id":"ASB-A-401256328-6cd52694","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401256328.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-401256328-3512d2b8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"function":"PkgUser","file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"length":75,"function_hash":"240764946324075854173994847004737990322"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200022116920192794837966910784835980386","57233620267693891124038157513111778797","333953230270992963311973259353359410477","324316816806016295360820776409309305563","93911001127874547445709805665773492397","139802966142082393163616442078014969","12262675147559931215374000589747710487","190420132181656345981628327849512467352","192317175273104458627111905836037941753","17689362358359657338713834903592578519","93194188375933297925873444413804359157","245256544450743878772069354856791681272","305510806987019648453778953207025737555","221144551137298854800971737185443471085","315102600677669206119257331320538597303","112433762888012341279837149390968255568"]},"id":"ASB-A-401256328-390c062b"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481","target":{"function":"PkgUser","file":"services/core/java/com/android/server/slice/SlicePermissionManager.java"},"deprecated":false,"digest":{"length":218,"function_hash":"157130551415955598566352797403227380524"},"id":"ASB-A-401256328-9fac9712","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3dfe8f615ed540e52c68bb46e17b3ada3e88b481"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401256328.json"}}],"schema_version":"1.9.0"}