Possible EvilParcel bug in GateKeeperResponse class

2022-06-0100:00:00

Google

osv.dev

gatekeeperresponse

bug

privilege escalation

user execution

software

AI Score

7.1

Confidence

High

EPSS

Percentile

5.1%

JSON

In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

References

android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760

source.android.com/security/bulletin/2022-06-01