PUB-A-171495100

See a problem?

Import Source

https://storage.googleapis.com/android-osv/PUB-A-171495100.json

JSON Data

https://api.osv.dev/v1/vulns/PUB-A-171495100

Aliases

A-171495100
CVE-2022-20204

Published

2022-06-01T00:00:00Z

Modified

2024-11-06T12:16:03.231308Z

Summary

[none]

Details

In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2022-06-01

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12L-next:0

Fixed

12L-next:2022-06-01

Affected versions

Other

12L-next

Ecosystem specific

{
    "vanir_signatures": [
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 896.0,
                "function_hash": "43394098026711568904688223253399089522"
            },
            "id": "PUB-A-171495100-02d4fa5a",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "BugreportInfo"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 1973.0,
                "function_hash": "143124606026022984317560122710176508176"
            },
            "id": "PUB-A-171495100-0c662371",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "requestBugReportWithDescription"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "199467781227995332449719358867354624185",
                    "81145784797266711795509234977883025050",
                    "290071508793857913796587695625872982687",
                    "180391091017719417976959037300753501987",
                    "12978541085817512337948410269795550609",
                    "68077402472135631655203994559341361656",
                    "155852669922656336683897492081575580490",
                    "179036972304746424785430980152620654161",
                    "87494284027708935601148285712336820876",
                    "134209951690152479315853012808420384781",
                    "336715371056664688736466993795850730382",
                    "49262635493516352159733351503255909387",
                    "67791727794083830703140327573071636609",
                    "102846366802878842735572401577134737772",
                    "251622667379496030971194680750693739456",
                    "303973867199134061417256230698994420270",
                    "44973334737331154544507463793525956202",
                    "78342051384350935199873677419867239443",
                    "288173527268122915928947849763606560286",
                    "16944173145014927680870018655612686526",
                    "249672125853255965167085216940158374029",
                    "203133953822724327942276231820147846189",
                    "308007863869655357313442875023500743832",
                    "318194236413321272786878276802076167307",
                    "28421101371200743065071176557512863806",
                    "129541302179883735063433926107653315912",
                    "138581321621043443499885446667321352396",
                    "206754363963698008518586022397668817720",
                    "161613523233780073102635856434109072422",
                    "97634628465229911114848194570004300773",
                    "170706851678826021428561428074183902618",
                    "191251205031226745428063494784996303443",
                    "29610294267099467205519254964066367504",
                    "240027687100756705963423639462119084703",
                    "17767854768053344209685549345596033068",
                    "217641896663230319468669828090858705690",
                    "108008200617279989750381039956206869531",
                    "286204025811496821767194585033873139965",
                    "176666683423466015763011337360989310003",
                    "635156752936221863749497432094965443",
                    "324346983795653312194135438264030486067",
                    "93504989169904609719425383104335367405",
                    "279391506304257887500786549822834803159",
                    "281112959155691559256645321020937976454"
                ]
            },
            "id": "PUB-A-171495100-213589f9",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "11974717292614229665125781150732126911",
                    "224626151571504496279568282677933767342",
                    "9033748220050446436383032833880146942"
                ]
            },
            "id": "PUB-A-171495100-23d788fc",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/app/admin/DevicePolicyManager.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 887.0,
                "function_hash": "59189546060763283399139927039997248448"
            },
            "id": "PUB-A-171495100-381a7f3f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java",
                "function": "requestBugreport"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 728.0,
                "function_hash": "304619747940281548858900589500034375992"
            },
            "id": "PUB-A-171495100-723a2dc1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java",
                "function": "onBugreportFinished"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 91.0,
                "function_hash": "330742450136530391253839069133262440354"
            },
            "id": "PUB-A-171495100-7f62be44",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "requestRemoteBugReport"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "333785043869998895598246558587411058005",
                    "99483968783869442725035170362996912675",
                    "116544507474930307210721706820507560154",
                    "149939898631446473464401674601044636453",
                    "231395100242204413377938674654908220357",
                    "4103252588248049375276403893125239504",
                    "72181448623870537767179570719583949038",
                    "137473533426836388275110939404713085229",
                    "37416203191937726643785462696998403343",
                    "128205157592908220455500669963110939763",
                    "246445266476099651357443284841001827369",
                    "145300328052590987059654688050992776360",
                    "253075435437442112356854748975122546240",
                    "151853178279769894980162476290537396862",
                    "211281637954740414970146433724985293741",
                    "35556733328047273966799777727626272884",
                    "18017850616947726909079256333152632170",
                    "154185861398598651456966464692339600194",
                    "9988619129823391200458753587179550201",
                    "128711847308751908646075009038571656872"
                ]
            },
            "id": "PUB-A-171495100-872ceb14",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 443.0,
                "function_hash": "337870246048598568174606142846103967345"
            },
            "id": "PUB-A-171495100-90e7a250",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "BugreportInfo"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 877.0,
                "function_hash": "282318806279972422464837673501261912036"
            },
            "id": "PUB-A-171495100-94acf696",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "writeToParcel"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 685.0,
                "function_hash": "179783799270717389689997767768854914157"
            },
            "id": "PUB-A-171495100-a28aef28",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "sendRemoteBugreportFinishedBroadcast"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 525.0,
                "function_hash": "68716271567379599365454762161697468820"
            },
            "id": "PUB-A-171495100-a3451ee4",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "sendBugreportFinishedBroadcastLocked"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 1762.0,
                "function_hash": "101745305161945802815612531538822999521"
            },
            "id": "PUB-A-171495100-ed871be4",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/Shell/src/com/android/shell/BugreportProgressService.java",
                "function": "startBugreportAPI"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 103.0,
                "function_hash": "334265612194035525934422498753300521342"
            },
            "id": "PUB-A-171495100-f08286ae",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "requestBugReport"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "41526336120789258751631375648463707103",
                    "1074755096598595873739467166931102845",
                    "175513794508249875206758989570143435511",
                    "282042604971335524280848016425741629172",
                    "98546925220534415701362301405720130024",
                    "15352909086097045530791399925344081588",
                    "324852663947952713305275727542123350715",
                    "307919466458131096867162215641302426162",
                    "176107429516770366567617423973421501110",
                    "138608444420076444183905780226611286739",
                    "329567354823053384322707578014228955363",
                    "229033139142433619136087419844097754091",
                    "7761918780391578288213429580710761603",
                    "297873503830133774202609679139883024199",
                    "112247284047854816040115288922956967595",
                    "265164371759118056113967205892745872864",
                    "76394916716579908478088989534202258380",
                    "311358628604606093534629859722367999449",
                    "302346794004477225882675061212700194363",
                    "113840666142760906506221613573461164037",
                    "64528573920877051427983890541962188494"
                ]
            },
            "id": "PUB-A-171495100-f7b3bdc3",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"
    ],
    "spl": "2022-06-01",
    "severity": "Moderate",
    "types": [
        "EoP"
    ]
}