In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.
Weakness
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Android | 14.0 (including) | 14.0 (including) | |
| Android | 15.0 (including) | 15.0 (including) | |
| Android | 16.0 (including) | 16.0 (including) | |
| Android | 16.0-qpr2_beta_1 (including) | 16.0-qpr2_beta_1 (including) | |
| Android | 16.0-qpr2_beta_2 (including) | 16.0-qpr2_beta_2 (including) | |
| Android | 16.0-qpr2_beta_3 (including) | 16.0-qpr2_beta_3 (including) |