{"id":"ASB-A-430568718","details":"In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-430568718","CVE-2025-48614"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/ec0c32ea736ba3c594352c345358a778334bc773"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"76421515011860320014570075502567652354","length":1436},"id":"ASB-A-430568718-0e670723","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/72f795b3bcb0c98971f5f15689c9399c8160bfcb","target":{"function":"rebootWipeUserData","file":"core/java/android/os/RecoverySystem.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["269248373998600226275533148607210253689","222380702083901883222102459968461839467","282461293848857152542591188526176889530","270028746291264465933292988178428669578","325856023358993064821580790567210336502","154431341608539965336464916639016996996","178340145540083051072777725291806384465","115776975346740262471787869178933106568","120116992438438021366100456728984052227","133795292970660049186326309057234612009","72756317919712360037787139582870286389"],"threshold":0.9},"id":"ASB-A-430568718-b55a8541","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/72f795b3bcb0c98971f5f15689c9399c8160bfcb","target":{"file":"core/java/android/os/RecoverySystem.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/72f795b3bcb0c98971f5f15689c9399c8160bfcb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-430568718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/156dac8a424208057390dd27f78307eab0281af0"],"severity":"High","spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"76421515011860320014570075502567652354","length":1436},"id":"ASB-A-430568718-9cb3fd5a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/156dac8a424208057390dd27f78307eab0281af0","target":{"function":"rebootWipeUserData","file":"core/java/android/os/RecoverySystem.java"}},{"digest":{"threshold":0.9,"line_hashes":["269248373998600226275533148607210253689","222380702083901883222102459968461839467","282461293848857152542591188526176889530","270028746291264465933292988178428669578","325856023358993064821580790567210336502","154431341608539965336464916639016996996","178340145540083051072777725291806384465","115776975346740262471787869178933106568","120116992438438021366100456728984052227","133795292970660049186326309057234612009","72756317919712360037787139582870286389"]},"id":"ASB-A-430568718-bc978871","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/156dac8a424208057390dd27f78307eab0281af0","target":{"file":"core/java/android/os/RecoverySystem.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-430568718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"target":{"file":"core/java/android/os/RecoverySystem.java","function":"rebootWipeUserData"},"deprecated":false,"digest":{"length":1436,"function_hash":"76421515011860320014570075502567652354"},"id":"ASB-A-430568718-7d6373d2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0846e0773b3f2fc54ec2e9674f55115f84d64e1e"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0846e0773b3f2fc54ec2e9674f55115f84d64e1e","target":{"file":"core/java/android/os/RecoverySystem.java"},"deprecated":false,"digest":{"line_hashes":["269248373998600226275533148607210253689","222380702083901883222102459968461839467","282461293848857152542591188526176889530","270028746291264465933292988178428669578","325856023358993064821580790567210336502","154431341608539965336464916639016996996","178340145540083051072777725291806384465","115776975346740262471787869178933106568","120116992438438021366100456728984052227","133795292970660049186326309057234612009","72756317919712360037787139582870286389"],"threshold":0.9},"id":"ASB-A-430568718-8264ec74"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0846e0773b3f2fc54ec2e9674f55115f84d64e1e"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-430568718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"282362617145924826965008281781698232913","length":1351},"id":"ASB-A-430568718-888846dd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/568e869321c1f13036a1b922625e1a713426f890","target":{"function":"rebootWipeUserData","file":"core/java/android/os/RecoverySystem.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/568e869321c1f13036a1b922625e1a713426f890","target":{"file":"core/java/android/os/RecoverySystem.java"},"deprecated":false,"digest":{"line_hashes":["269248373998600226275533148607210253689","222380702083901883222102459968461839467","282461293848857152542591188526176889530","270028746291264465933292988178428669578","11041327084402580920241686294457413431","38007437332597978895441645623598737235","118711258486853669429896570521845340043","115776975346740262471787869178933106568","120116992438438021366100456728984052227","133795292970660049186326309057234612009","72756317919712360037787139582870286389"],"threshold":0.9},"id":"ASB-A-430568718-986b0eee","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/568e869321c1f13036a1b922625e1a713426f890"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-430568718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":1351,"function_hash":"282362617145924826965008281781698232913"},"id":"ASB-A-430568718-51974efe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/81c13460b5531e45bc5c7f6b93b3fff3e61e0da2","target":{"file":"core/java/android/os/RecoverySystem.java","function":"rebootWipeUserData"}},{"deprecated":false,"digest":{"line_hashes":["269248373998600226275533148607210253689","222380702083901883222102459968461839467","282461293848857152542591188526176889530","270028746291264465933292988178428669578","11041327084402580920241686294457413431","38007437332597978895441645623598737235","118711258486853669429896570521845340043","115776975346740262471787869178933106568","120116992438438021366100456728984052227","133795292970660049186326309057234612009","72756317919712360037787139582870286389"],"threshold":0.9},"id":"ASB-A-430568718-ba7abb64","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/81c13460b5531e45bc5c7f6b93b3fff3e61e0da2","target":{"file":"core/java/android/os/RecoverySystem.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/81c13460b5531e45bc5c7f6b93b3fff3e61e0da2"],"severity":"High","spl":"2025-12-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-430568718.json"}}],"schema_version":"1.9.0"}