CVE-2017-13316

In checkPermissions of RecognitionService.java, there is a possiblepermissions bypass due to a missing permission check. This could lead tolocal escalation of privilege with no additional execution privilegesneeded. User interaction is not needed for exploitation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
google_androidCNA
---
---
CISA-ADPADP
8.4 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
VendorProductVersion
googleandroid
6.0
googleandroid
6.0.1
googleandroid
7.0
googleandroid
7.1.1
googleandroid
7.1.2
googleandroid
8.0
googleandroid
8.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://source.android.com/security/bulletin/pixel/2018-05-01