Vulnetix
Try Vulnetix Request Demo
ASB-A-324321147 PUBLISHED

In rebootRecoveryWithCommand of RecoverySystemService.java, there is a possible way to bypass a factory reset due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Products

VendorProductVersions
platformsystem/sepolicy15-next, 12, 12:0
platformbuild/soong15-next, 15-next:0, 15-next
platformhardware/interfaces15-next:0, 15-next, 15-next:0
platformframeworks/base14, *, 13

Timeline

References

Open in Interactive Console →