{"id":"ASB-A-517376998","details":"In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517376998","CVE-2026-59001"],"modified":"2026-11-02T16:56:13.803767823Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53","target":{"function":"findAndRestoreAllMatches","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"length":4163,"function_hash":"216061306196585981300064809507201569928"},"id":"ASB-A-517376998-8b8254f7","match_only_versions":["17-qpr2-next"]},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53","target":{"function":"checkQueryPermission","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"length":458,"function_hash":"7976586926259062484835703724006128362"},"id":"ASB-A-517376998-c91b9ade","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/001e127477fed2e91f216d977acf909a4168dc53","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["53936002122569484815290621246871179949","70576509121161960376188339518662761061","297428313761486677327718079304819386556","118794406390172136314128945416235955464","300584787152345170242481932407377887275","91000279944401502212300301446449121768","314946229393751904642575607985901090074","48071387772265113611768738447220227872","230892233880439695298943081283800815836","91046966655524689967478206889217130047","284773454721187922326320860369632290220","267054189197332168947210187875360688486","271893851611037262668931233880873809199","210369113040066875555737840015415699291","298074511415231411534212404752852116128","25703267387421632776396060978389066432","273044155702715912844332262120968811210","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"]},"id":"ASB-A-517376998-d3d45b53","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["240433238494184810143839656530126187511","8427543793721969093118965675091271151","17910702747122044722567336726290983731","129282611143923013123369356572484533716","211450648062654852176228427153150408841","123458277809245106179093615932180321350","340115021886211851926004528943838715928","31223123999661288800207941957039316100","98068253949951945928588739056383828019","4138818049494596484870303350329687508","61199313712577237046067941375398079003","125124786717500389013768378564162325021","168692056166021226967507375135811790917","24510490044451189075102797641655409022","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"],"threshold":0.9},"id":"ASB-A-517376998-047677bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"}},{"id":"ASB-A-517376998-3e44e3d8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionForApnTable"},"deprecated":false,"digest":{"length":607,"function_hash":"133759318633514576147821054749434568423"}},{"deprecated":false,"digest":{"function_hash":"7976586926259062484835703724006128362","length":458},"id":"ASB-A-517376998-45263833","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkQueryPermission"}},{"id":"ASB-A-517376998-533f5bb3","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519","target":{"file":"tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"},"deprecated":false,"digest":{"line_hashes":["178943418797874659006337080546758787415","254426424400320467474497305036242758145","83974394610340653447941319089408175950","319796118768737917365418783325404363194","264288317705191403379031113407962083954","337451599964745881534083711978499529968","321779854046422385171112623528674007525","71784267710571752780925340652729611155","49862630043043235314643615992343296383","250554287766018351313053081232812084538"],"threshold":0.9}},{"digest":{"function_hash":"222110957754234632793106596897145323606","length":324},"id":"ASB-A-517376998-ecf34087","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionCompat"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ba709de0ad425b00d79ed15eaf2abf0177033519"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-517376998-27accb24","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3","target":{"file":"tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178943418797874659006337080546758787415","254426424400320467474497305036242758145","83974394610340653447941319089408175950","319796118768737917365418783325404363194","264288317705191403379031113407962083954","337451599964745881534083711978499529968","321779854046422385171112623528674007525","71784267710571752780925340652729611155","49862630043043235314643615992343296383","250554287766018351313053081232812084538"]}},{"id":"ASB-A-517376998-4e522157","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3","target":{"function":"checkQueryPermission","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"length":458,"function_hash":"7976586926259062484835703724006128362"}},{"id":"ASB-A-517376998-9fedb150","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionCompat"},"deprecated":false,"digest":{"length":324,"function_hash":"222110957754234632793106596897145323606"}},{"target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionForApnTable"},"deprecated":false,"digest":{"length":716,"function_hash":"45238555306102366473307333753867188196"},"id":"ASB-A-517376998-a1d14232","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["240433238494184810143839656530126187511","8427543793721969093118965675091271151","17910702747122044722567336726290983731","129282611143923013123369356572484533716","145449402105482051351096302505063513080","229525023229349362386399826596819554960","59551926140787356963347667253666440099","31223123999661288800207941957039316100","98068253949951945928588739056383828019","4138818049494596484870303350329687508","61199313712577237046067941375398079003","125124786717500389013768378564162325021","168692056166021226967507375135811790917","24510490044451189075102797641655409022","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"]},"id":"ASB-A-517376998-f3b0651b","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8c4f3d534655633cef740d0eedc5c9e7068672c3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"line_hashes":["240433238494184810143839656530126187511","8427543793721969093118965675091271151","17910702747122044722567336726290983731","129282611143923013123369356572484533716","226197694517301515154906915255327386937","286612548340133698947489893572453287830","215763414543607856149625014482400368364","31223123999661288800207941957039316100","98068253949951945928588739056383828019","4138818049494596484870303350329687508","61199313712577237046067941375398079003","125124786717500389013768378564162325021","168692056166021226967507375135811790917","24510490044451189075102797641655409022","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"],"threshold":0.9},"id":"ASB-A-517376998-8324c6ba","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1"},{"match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1","target":{"file":"tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178943418797874659006337080546758787415","254426424400320467474497305036242758145","83974394610340653447941319089408175950","319796118768737917365418783325404363194","264288317705191403379031113407962083954","337451599964745881534083711978499529968","321779854046422385171112623528674007525","71784267710571752780925340652729611155","49862630043043235314643615992343296383","250554287766018351313053081232812084538"]},"id":"ASB-A-517376998-a898b5fe"},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionCompat"},"deprecated":false,"digest":{"length":324,"function_hash":"222110957754234632793106596897145323606"},"id":"ASB-A-517376998-cd18a52b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionForApnTable"},"deprecated":false,"digest":{"function_hash":"71762686510462485380730577436550643817","length":684},"id":"ASB-A-517376998-ce567c5d","match_only_versions":["16-qpr2"]},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkQueryPermission"},"deprecated":false,"digest":{"length":458,"function_hash":"7976586926259062484835703724006128362"},"id":"ASB-A-517376998-dc7c3037","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3879579433fbfb64aa109b34e7ac4e11d0715ff1"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionCompat"},"deprecated":false,"digest":{"function_hash":"222110957754234632793106596897145323606","length":324},"id":"ASB-A-517376998-297f1d45"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"line_hashes":["240433238494184810143839656530126187511","8427543793721969093118965675091271151","17910702747122044722567336726290983731","129282611143923013123369356572484533716","226197694517301515154906915255327386937","286612548340133698947489893572453287830","215763414543607856149625014482400368364","31223123999661288800207941957039316100","98068253949951945928588739056383828019","4138818049494596484870303350329687508","61199313712577237046067941375398079003","125124786717500389013768378564162325021","168692056166021226967507375135811790917","24510490044451189075102797641655409022","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"],"threshold":0.9},"id":"ASB-A-517376998-687f2145"},{"match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8","target":{"file":"tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178943418797874659006337080546758787415","254426424400320467474497305036242758145","83974394610340653447941319089408175950","319796118768737917365418783325404363194","264288317705191403379031113407962083954","337451599964745881534083711978499529968","321779854046422385171112623528674007525","71784267710571752780925340652729611155","49862630043043235314643615992343296383","250554287766018351313053081232812084538"]},"id":"ASB-A-517376998-74827288"},{"digest":{"function_hash":"7976586926259062484835703724006128362","length":458},"id":"ASB-A-517376998-9aa0e0d0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8","target":{"function":"checkQueryPermission","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false},{"match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8","target":{"function":"checkPermissionForApnTable","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"function_hash":"71762686510462485380730577436550643817","length":684},"id":"ASB-A-517376998-b5e9ecd2"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6ece5a13d535bdf55f2d318596724ec404969df8"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc","target":{"file":"tests/src/com/android/providers/telephony/TelephonyProviderTestable.java"},"deprecated":false,"digest":{"line_hashes":["178943418797874659006337080546758787415","254426424400320467474497305036242758145","83974394610340653447941319089408175950","319796118768737917365418783325404363194","264288317705191403379031113407962083954","337451599964745881534083711978499529968","321779854046422385171112623528674007525","71784267710571752780925340652729611155","49862630043043235314643615992343296383","250554287766018351313053081232812084538"],"threshold":0.9},"id":"ASB-A-517376998-0279e6d6"},{"id":"ASB-A-517376998-0f05876c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkQueryPermission"},"deprecated":false,"digest":{"function_hash":"7976586926259062484835703724006128362","length":458}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java","function":"checkPermissionForApnTable"},"deprecated":false,"digest":{"function_hash":"133759318633514576147821054749434568423","length":607},"id":"ASB-A-517376998-26364dc5","signature_type":"Function"},{"id":"ASB-A-517376998-45179a2a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc","target":{"function":"checkPermissionCompat","file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"length":324,"function_hash":"222110957754234632793106596897145323606"}},{"id":"ASB-A-517376998-cbc95869","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc","target":{"file":"src/com/android/providers/telephony/TelephonyProvider.java"},"deprecated":false,"digest":{"line_hashes":["240433238494184810143839656530126187511","8427543793721969093118965675091271151","17910702747122044722567336726290983731","129282611143923013123369356572484533716","211450648062654852176228427153150408841","123458277809245106179093615932180321350","340115021886211851926004528943838715928","31223123999661288800207941957039316100","98068253949951945928588739056383828019","4138818049494596484870303350329687508","61199313712577237046067941375398079003","125124786717500389013768378564162325021","168692056166021226967507375135811790917","24510490044451189075102797641655409022","45144815370482708907229697490453851924","91733330381032293994465764465049641403","41093927655112614800845340185873384104","230978211482868517648612192544250696848"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fc05ba7969977d9c9e2c6f364aa8c54cb69be6dc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376998.json"}}],"schema_version":"1.9.2"}