{"id":"ASB-A-417988098","details":"In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-417988098","CVE-2025-48633"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/a8819d3bdc496d3a4b5ea041434ff5d71b1f8c95","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"line_hashes":["228627409854854366920249968764744863575","112758038984776877850116512949538155554","279100164488443653505373466994203365574","312430612973083313531656263379661982871","174136908777338641885721446830945073462","210486942932395435650090752026016186599","82768522421096348039197161844264814895","12959855043758291770418159949942857401","14743293529936974676583240089675958297","114023606051986100405342786167960816485","289018824553411596236786754493969215023","184978904748512204470877337638793500747","134740195501709402976504490245098310384","70240218339882788536549213938104471009","313782378611338187130601511332942839768","102773042227712380051185624212894701760","89473433834476336072960756605294898981","274356538685267123918532653911816561589","265289797900258886413689574868679093053","305626251967523633557600181552379173028","240094929358021849080060019783533587618","66337160365168716822454222546076431092"],"threshold":0.9},"id":"ASB-A-417988098-53c5e9c3","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"47098530988569470138235014943703581247","length":370},"id":"ASB-A-417988098-6f20cd57","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a8819d3bdc496d3a4b5ea041434ff5d71b1f8c95","target":{"function":"hasAccountsOnAnyUser","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a8819d3bdc496d3a4b5ea041434ff5d71b1f8c95"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-417988098.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-12-01","types":["ID"],"vanir_signatures":[{"match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/18eeec99a1bf4a569abb2cf03199b5c8de47c3e2","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"line_hashes":["228627409854854366920249968764744863575","112758038984776877850116512949538155554","279100164488443653505373466994203365574","238007327852204588133038310093592302728","174136908777338641885721446830945073462","210486942932395435650090752026016186599","82768522421096348039197161844264814895","12959855043758291770418159949942857401","14743293529936974676583240089675958297","114023606051986100405342786167960816485","289018824553411596236786754493969215023","184978904748512204470877337638793500747","134740195501709402976504490245098310384","70240218339882788536549213938104471009","313782378611338187130601511332942839768","102773042227712380051185624212894701760","89473433834476336072960756605294898981","274356538685267123918532653911816561589","265289797900258886413689574868679093053","305626251967523633557600181552379173028","240094929358021849080060019783533587618","66337160365168716822454222546076431092"],"threshold":0.9},"id":"ASB-A-417988098-84123916"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/18eeec99a1bf4a569abb2cf03199b5c8de47c3e2","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java","function":"hasAccountsOnAnyUser"},"deprecated":false,"digest":{"length":370,"function_hash":"47098530988569470138235014943703581247"},"id":"ASB-A-417988098-a7e035da","match_only_versions":["15"]}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/18eeec99a1bf4a569abb2cf03199b5c8de47c3e2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-417988098.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["ID"],"vanir_signatures":[{"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java","function":"hasAccountsOnAnyUser"},"deprecated":false,"digest":{"length":370,"function_hash":"47098530988569470138235014943703581247"},"id":"ASB-A-417988098-973d419e","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cb19a42cad9ada4494402d78bbe47c00fe1a9bfb"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/cb19a42cad9ada4494402d78bbe47c00fe1a9bfb","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"line_hashes":["228627409854854366920249968764744863575","112758038984776877850116512949538155554","279100164488443653505373466994203365574","238007327852204588133038310093592302728","174136908777338641885721446830945073462","210486942932395435650090752026016186599","82768522421096348039197161844264814895","12959855043758291770418159949942857401","14743293529936974676583240089675958297","114023606051986100405342786167960816485","289018824553411596236786754493969215023","184978904748512204470877337638793500747","134740195501709402976504490245098310384","70240218339882788536549213938104471009","313782378611338187130601511332942839768","102773042227712380051185624212894701760","89473433834476336072960756605294898981","274356538685267123918532653911816561589","265289797900258886413689574868679093053","305626251967523633557600181552379173028","240094929358021849080060019783533587618","66337160365168716822454222546076431092"],"threshold":0.9},"id":"ASB-A-417988098-9a53c70c","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cb19a42cad9ada4494402d78bbe47c00fe1a9bfb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-417988098.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"115177620488067154841259197973932496223","length":2089},"id":"ASB-A-417988098-131ced8f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dcf48a6c859809aa110998db1e6ce0fe55a076a4","target":{"function":"setDeviceOwner","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}},{"deprecated":false,"digest":{"line_hashes":["33260104429753638318237273459397079142","203110419403296242137638840669081757511","125505593870081991501639928054858609553","257449320452807396116395594763144151000","192813906572782867152156975367079184998","52413297175982395892476449493682435981","25818311049377831879220737137205976661","209003801667110911814098593016038907241","321124709650192897648215414340735088190","335507836176658651659843300690493693091","239693514085725805911559505103812188783"],"threshold":0.9},"id":"ASB-A-417988098-4550374b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dcf48a6c859809aa110998db1e6ce0fe55a076a4","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}},{"deprecated":false,"digest":{"function_hash":"115177620488067154841259197973932496223","length":2089},"id":"ASB-A-417988098-b91e034b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0709fe7f702d1145515130bb4113b8ee65456812","target":{"function":"setDeviceOwner","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0709fe7f702d1145515130bb4113b8ee65456812","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["33260104429753638318237273459397079142","203110419403296242137638840669081757511","125505593870081991501639928054858609553","257449320452807396116395594763144151000","192813906572782867152156975367079184998","52413297175982395892476449493682435981","25818311049377831879220737137205976661","209003801667110911814098593016038907241","321124709650192897648215414340735088190","335507836176658651659843300690493693091","239693514085725805911559505103812188783"]},"id":"ASB-A-417988098-d7f790db"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0709fe7f702d1145515130bb4113b8ee65456812","https://android.googlesource.com/platform/frameworks/base/+/fe6955ed5b9224a5b29eedf529550f4a85b2237c","https://android.googlesource.com/platform/frameworks/base/+/dcf48a6c859809aa110998db1e6ce0fe55a076a4"],"severity":"High","spl":"2025-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-417988098.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["303202455033692607252058234388515915159","112758038984776877850116512949538155554","279100164488443653505373466994203365574","238007327852204588133038310093592302728","174136908777338641885721446830945073462","210486942932395435650090752026016186599","82768522421096348039197161844264814895","12959855043758291770418159949942857401","14743293529936974676583240089675958297","114023606051986100405342786167960816485","289018824553411596236786754493969215023","184978904748512204470877337638793500747","134740195501709402976504490245098310384","70240218339882788536549213938104471009","313782378611338187130601511332942839768","102773042227712380051185624212894701760","89473433834476336072960756605294898981","274356538685267123918532653911816561589","265289797900258886413689574868679093053","305626251967523633557600181552379173028","240094929358021849080060019783533587618","66337160365168716822454222546076431092"],"threshold":0.9},"id":"ASB-A-417988098-07694abb","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd675b76b3bf8ce693f7296ad5a88c040dae2169","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}},{"match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd675b76b3bf8ce693f7296ad5a88c040dae2169","target":{"function":"hasAccountsOnAnyUser","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"length":370,"function_hash":"47098530988569470138235014943703581247"},"id":"ASB-A-417988098-243e113c"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd675b76b3bf8ce693f7296ad5a88c040dae2169"],"severity":"High","spl":"2025-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-417988098.json"}}],"schema_version":"1.9.0"}