Insecure Permissions in Feng Island Allow Denial of Service

Executive Summary

This vulnerability involves insecure permissions in the FeatureActionActivity component of Oasis Feng Island version 51801. An exported activity allows unauthorized apps to clear a device freeze state and launch apps across profile borders without user interaction. The issue stems from improper export of Android components (CWE-926), enabling state manipulation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Insular (com.oasisfeng.island.fdroid) version 51801 for Android. To detect it, check if the vulnerable app is installed and running version 51801. Use Android Debug Bridge (ADB) commands like 'adb shell dumpsys package com.oasisfeng.island.fdroid | grep versionCode' to verify the version. Inspect exported components in the app's manifest for improperly exported activities.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to force a device freeze (DoS) and manipulate app states without permission. The attack requires Island to be set as profile owner and the target app installed in that profile. No user interaction is needed for the freeze state manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Insular to the latest version if available. If no update exists, restrict access to the vulnerable component by setting android:exported="false" in the app's manifest or apply android:permission restrictions. Uninstall Insular version 51801 if updates are unavailable. Avoid using Island or Insular as a profile owner until a patch is released.

Useful 0 Not Useful 0