{"id":"ASB-A-454062218","details":"In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-454062218","CVE-2026-0011"],"modified":"2026-04-17T15:55:28.020024Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/51368785bd09cd652ed9851727b16545cb92c4e5"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-03-01","vanir_signatures":[{"digest":{"function_hash":"284319997343437165940897188224211807351","length":661},"id":"ASB-A-454062218-16d6e914","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","deprecated":false,"target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-502158f4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","deprecated":false,"target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-6148dbcd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"288397329113914151108030394943692643022","length":11716},"id":"ASB-A-454062218-c496a497","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","deprecated":false,"target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/dba78af51647402d8233bd4c52ecb3c3551622a4","https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-03-01","vanir_signatures":[{"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-03620439","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"334617102533654471552284364481224219330","length":10768},"id":"ASB-A-454062218-4929763e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","deprecated":false,"target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"284319997343437165940897188224211807351","length":661},"id":"ASB-A-454062218-6668a63c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","deprecated":false,"target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-ad073264","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","deprecated":false,"target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-03-01","vanir_signatures":[{"digest":{"function_hash":"284319997343437165940897188224211807351","length":661},"id":"ASB-A-454062218-6c616d47","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","deprecated":false,"target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"211106132936534084502720084199233022640","length":11182},"id":"ASB-A-454062218-c721a06b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","deprecated":false,"target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-ccc4fb5c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-e6bcb9cd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","deprecated":false,"target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-03-01","vanir_signatures":[{"digest":{"function_hash":"284319997343437165940897188224211807351","length":661},"id":"ASB-A-454062218-328e701e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","deprecated":false,"target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-3ad9431f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","deprecated":false,"target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-5d481de1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"264395599137339639107651047999758842093","length":11613},"id":"ASB-A-454062218-d459f8fa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","deprecated":false,"target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-03-01","vanir_signatures":[{"digest":{"function_hash":"137784312276013940340327891707124488837","length":9995},"id":"ASB-A-454062218-80b7dc02","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","deprecated":false,"target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"line_hashes":["224402722255896372297002727977158473518","64902452747486425988219297442902021335","50901606693728845590594171921752281941","292156504327675538663829928951282757895","164481467575030133943999691231751841547","37406276584328005671714621304520468273","215148686837882964143970126678391733537","335516374965104949799896044360537153888","168140497931974869983212923874137392983","156531654576830406430712702951441447560","138393851297676093797771619697090569653","228718581690540988277919725956730339920","83885092042609357490336318926515996256","45606039818385214155443337296054601198","132383651890466863833289270875205444764","310809837497482768015315402934777498564","38510742911989735377743417480857656159","213400700073499038942915101588328699376","68298697726680042253384060064172673124"],"threshold":0.9},"id":"ASB-A-454062218-83662c44","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"135924383374685116244805398144046121058","length":806},"id":"ASB-A-454062218-879ccb76","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","deprecated":false,"target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}},{"digest":{"function_hash":"240461939662953300303024880342708923427","length":913},"id":"ASB-A-454062218-ce17854c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","deprecated":false,"target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"}}],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}}],"schema_version":"1.7.5"}