{"id":"ASB-A-428945391","details":"In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-428945391","CVE-2025-48581"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/apex/+/5a33fa4202cb5f06d7f02f3a2b8d13780d7cb3f5"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/apex/+/13bbfe3ef2953e9805d57d3219cc122e485ba90f"},{"type":"FIX","url":"https://android.googlesource.com/platform/system/apex/+/117f34be6322c6a608a1c3e06f1d03ec32da60b3"}],"affected":[{"package":{"name":"platform/build","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/build/+/a89e1ec183c96413380b5e2db37581b7031d04ea"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-428945391.json"}},{"package":{"name":"platform/system/apex","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["175917095348843160700424818166486520653","30425094193163543155963132339065551264","299251075908848645897139723645939297160","275730233787607256365024819872528287055","205824012699372239740774163840791275833","148118273040957037683679203715463304634","52108119062793506449817648475710431310","89436116488515070387007099259755383256","183696079466424190639803743696520507841","114477007463711046531956477069194721748","4020812786432045008653458036011727943","295481725748347345290013375034056990375"]},"id":"ASB-A-428945391-007f5cb7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111"},{"target":{"file":"apexd/apexd_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"121278165439356723875710429288290633327","length":312},"id":"ASB-A-428945391-06ed9e81","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111"},{"deprecated":false,"digest":{"function_hash":"166277273963399411157087798512642315690","length":596},"id":"ASB-A-428945391-300dfe9c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111","target":{"function":"VerifyNoOverlapInSessions","file":"apexd/apexd.cpp"}},{"source":"https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111","target":{"file":"apexd/apexd_test.cpp"},"deprecated":false,"digest":{"line_hashes":["52157845959511572691352331476719520445","217789726687832973363975091640464677103","226259752552317461791458198722527628200","234005877175019193026504174551496243218","234660702027869820818331263267980610251","154070696187209746810672341621860282179","29358273819798901044955327876350372115","303395101341504222598207390591217822317","313454767841376224634286675241210428431","287061343837500287771387032489256023353","142103851895818989805276152044261276839","102243921965501156304027347410701275629","162610883514293771637610730148472690826","114975212925962633791762223934937599880","272879143918057264466504474331999430965","113527164020389351472254726476464797231","196266306533798557804225872360412629272","282745649002026583143270617724075631605","219415052305547252475768502827317305082","337759656446115835035328561982834845054","6174480674815779188630459385428239866","278774742762054142479654539375391260310","164589572204029079691621865732970429974"],"threshold":0.9},"id":"ASB-A-428945391-c5faf4e8","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111","target":{"file":"apexd/apexd_test.cpp","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"255213190898107091193437316625706956132","length":383},"id":"ASB-A-428945391-f7008c37","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/apex/+/e8474ce3f0a27b9781b6eaf518520941a3820111","https://android.googlesource.com/platform/system/apex/+/fa11a4437b6a5d41d503fac3763ed0d17e5adeff","https://android.googlesource.com/platform/system/apex/+/8b89163d61b800ca56ce974e3546790b8617da9d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-428945391.json"}},{"package":{"name":"platform/build","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/build/+/de6947a70e8aaa521f9bcb4718eb53f7161d7bfc"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-428945391.json"}},{"package":{"name":"platform/system/apex","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-428945391-2529a41f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398","target":{"file":"apexd/apexd.cpp","function":"VerifyNoOverlapInSessions"},"deprecated":false,"digest":{"function_hash":"166277273963399411157087798512642315690","length":596}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398","target":{"file":"apexd/apexd_test.cpp"},"deprecated":false,"digest":{"line_hashes":["52157845959511572691352331476719520445","217789726687832973363975091640464677103","226259752552317461791458198722527628200","234005877175019193026504174551496243218","234660702027869820818331263267980610251","154070696187209746810672341621860282179","29358273819798901044955327876350372115","303395101341504222598207390591217822317","313454767841376224634286675241210428431","287061343837500287771387032489256023353","142103851895818989805276152044261276839","102243921965501156304027347410701275629","162610883514293771637610730148472690826","114975212925962633791762223934937599880","272879143918057264466504474331999430965","113527164020389351472254726476464797231","196266306533798557804225872360412629272","282745649002026583143270617724075631605","219415052305547252475768502827317305082","337759656446115835035328561982834845054","6174480674815779188630459385428239866","278774742762054142479654539375391260310","164589572204029079691621865732970429974"],"threshold":0.9},"id":"ASB-A-428945391-2af8eca0","signature_type":"Line"},{"deprecated":false,"digest":{"length":383,"function_hash":"255213190898107091193437316625706956132"},"id":"ASB-A-428945391-48066754","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398","target":{"file":"apexd/apexd_test.cpp","function":"TEST_F"}},{"target":{"file":"apexd/apexd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["175917095348843160700424818166486520653","30425094193163543155963132339065551264","299251075908848645897139723645939297160","275730233787607256365024819872528287055","205824012699372239740774163840791275833","148118273040957037683679203715463304634","52108119062793506449817648475710431310","89436116488515070387007099259755383256","183696079466424190639803743696520507841","114477007463711046531956477069194721748","4020812786432045008653458036011727943","295481725748347345290013375034056990375"]},"id":"ASB-A-428945391-4c5359f6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398","target":{"function":"TEST_F","file":"apexd/apexd_test.cpp"},"deprecated":false,"digest":{"function_hash":"121278165439356723875710429288290633327","length":312},"id":"ASB-A-428945391-c90a6a54"}],"fixes":["https://android.googlesource.com/platform/system/apex/+/43dd1249f40c5f4cbe06e236ed376b34ba418f2f","https://android.googlesource.com/platform/system/apex/+/b9c9fb3d71291fee7be9bd77b96f38c05dca3398","https://android.googlesource.com/platform/system/apex/+/9c3d1d96f93f380ad08058a26a8e2933e58e68b0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-428945391.json"}}],"schema_version":"1.9.0"}