PUB-A-215912712

See a problem?

Import Source

https://storage.googleapis.com/android-osv/PUB-A-215912712.json

JSON Data

https://api.osv.dev/v1/vulns/PUB-A-215912712

Aliases

A-215912712
CVE-2022-20192

Published

2022-06-01T00:00:00Z

Modified

2024-11-06T12:16:03.231308Z

Summary

[none]

Details

In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2022-06-01

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

12L-next:0

Fixed

12L-next:2022-06-01

Affected versions

Other

12L-next

Ecosystem specific

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "313447456436393578450352165333497830124",
                    "159955500546290620471829244372167147273",
                    "245617924789097587065637373491985033359",
                    "70144521634387495929408387018114747884"
                ]
            },
            "id": "PUB-A-215912712-149082c2",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/view/SurfaceControlViewHost.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 143.0,
                "function_hash": "194024574188936834744100268737628594644"
            },
            "id": "PUB-A-215912712-1e38d9f6",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "handleTap"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 132.0,
                "function_hash": "92553313247997798040609520744226570560"
            },
            "id": "PUB-A-215912712-3365a4eb",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/view/WindowlessWindowManager.java",
                "function": "grantInputChannel"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "307975587768630657536385743269940051042",
                    "129571895563961595208330825225029915569",
                    "120489534548518309952564322799305312665",
                    "27445558377941926899303527121623302029",
                    "83009492359691535269599834475066089122",
                    "242363125001361202027442195738523802670",
                    "193430401147455584132599762128029672180",
                    "252307567104734172389202811549445370403"
                ]
            },
            "id": "PUB-A-215912712-3b6800dd",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/Session.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 122.0,
                "function_hash": "286077618216485116393928546099126525768"
            },
            "id": "PUB-A-215912712-3b8bbad0",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "setIsOverlay"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 676.0,
                "function_hash": "77530300094508597560504939843687018762"
            },
            "id": "PUB-A-215912712-49362c67",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function": "grantInputChannel"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "17686737021801134923380760931005880650",
                    "132210580519469319004308320375968209526",
                    "135902169074890242786529065395667085453",
                    "30187238928623378357292221212913018032",
                    "158500292227387259793422493870531899135",
                    "157473994530248800087446969901926750414",
                    "3554624916982651199122831179499286397",
                    "5373408571869161308241790047671666283",
                    "66953031833224888004651101549771875584",
                    "308002791425092254437893004673275369641",
                    "143086098992670610811390418642917599747",
                    "226688251488303744678384744181807250507",
                    "28744171646912162897373354997722176788",
                    "183248130313831857096967850360844829331",
                    "264679056851131321556390357525872630029",
                    "244506510009072707629547047307058480209",
                    "5484813515024828678280736639974151607",
                    "98168165945816108946915812514391913682",
                    "32864287871794712483081317261691410616",
                    "307975587768630657536385743269940051042",
                    "76122052778904437714693575498100955843",
                    "48033696707075702793373996737808958665"
                ]
            },
            "id": "PUB-A-215912712-4b8de583",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/view/WindowlessWindowManager.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 391.0,
                "function_hash": "26648746563987095996461379873779715642"
            },
            "id": "PUB-A-215912712-5809bc4a",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "EmbeddedWindow"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "297132866356129439650247628412132940206",
                    "303174920548254133121225758823063549256",
                    "109557742843025099762672170855687702934",
                    "69973829266395234888277497072107976292",
                    "249843219509874571401603772089555660062",
                    "24653710417627992956245966885794157113",
                    "169040677913424862085535237249480690499",
                    "249907199183291378187878039204653452548",
                    "3749866508948667195742557577011334333",
                    "77263441175257790732450424250028220505",
                    "177957622856663355899147648742363637241",
                    "243921429939073473608254175591894653936",
                    "73707595581636883795601674902081331902",
                    "4506747250339806290505252663755546936",
                    "257092041894948712891274309638591096779",
                    "158119484667052230678308897110627972593",
                    "19949290075548675480522230015399142402",
                    "320419642726364248892969374714882777180",
                    "326676554179258231367588427284393663671",
                    "330867935844262064784760523924163530486",
                    "188440502342548759644947147361175416830",
                    "33992531273419836881674858884998877764",
                    "97908565003288610906637655430332640527",
                    "150843986792921702356071417120635481502",
                    "150793315461927662885318269813241933294",
                    "213615006389502183952880584716324614454",
                    "80968761831915418500289429567873788165",
                    "12145204086282955014349739303453612196",
                    "203229796909502848305444347090942722171",
                    "141619099370849310620842390982148257973",
                    "233378015265758761875105831540848551973",
                    "211690972711465642056024996780188750480",
                    "300367417729140805075720897656647256933",
                    "80856441254202053371134967527393534949",
                    "150965068896732489751237879777463821566"
                ]
            },
            "id": "PUB-A-215912712-6661ffd0",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 1355.0,
                "function_hash": "307620882436853427180252805866804008327"
            },
            "id": "PUB-A-215912712-850c6e6f",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function": "grantEmbeddedWindowFocus"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 218.0,
                "function_hash": "186121109985378599157501208163885875150"
            },
            "id": "PUB-A-215912712-87880c70",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "onWindowRemoved"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 1261.0,
                "function_hash": "41536229982092627211510767755923860933"
            },
            "id": "PUB-A-215912712-9252c3ef",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function": "grantEmbeddedWindowFocus"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 687.0,
                "function_hash": "160158412850212107467758691652300779593"
            },
            "id": "PUB-A-215912712-9fb14820",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/Session.java",
                "function": "grantInputChannel"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 244.0,
                "function_hash": "98708224717726924774764348833435963988"
            },
            "id": "PUB-A-215912712-a0006522",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/view/SurfaceControlViewHost.java",
                "function": "getSurfacePackage"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 309.0,
                "function_hash": "266004004414100078218679146360425037684"
            },
            "id": "PUB-A-215912712-a6b485f8",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "add"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "111122913986043214337648687681084523164",
                    "299774918102398556928784908050133470352",
                    "6118059391038327457806559238760912538",
                    "278458067052608528666234082641956102942",
                    "323613906290305568114569722105271513615",
                    "277319330415602910703870405813293221247",
                    "280131073050254959127190007161039388685",
                    "17872331650406894598956152418694951647",
                    "205576568369135978193934845198033430771",
                    "231713717433687464958838342660489226126",
                    "170663188789405533190498353211788284081",
                    "77947182356533165268875933500400719804",
                    "224297892110077318995490831236837626923",
                    "324841501861252544257182440998596363300",
                    "155415797501036940465374299616886532333",
                    "209500334405559091860346116591151656957",
                    "205634861642230201165349138536725773497",
                    "307417433900226098033894432326852079901",
                    "47964460560293716390272378901255958953",
                    "106587980582975620963396486030542256532",
                    "243274474365661135643073550980233253258",
                    "122298865036439001389740065468810292055",
                    "122887771776450033160385624682157852669",
                    "319174063616503398322351737414644904754",
                    "101923151356666984389465939473999578357",
                    "221684015862223591517238411370451932655",
                    "252476985300961096795137545560356861557",
                    "229223661845914667207247256007332721838",
                    "144213558391825386109111068533916020348",
                    "74727407718073676886435133196161375478",
                    "81007536294896407291950264245404796161",
                    "256450374089892551799521076228142348190",
                    "187961048826224832109048999708068771074",
                    "199944379225751195658832412295287763010",
                    "229075557150457164382327372980894757376",
                    "295111416493832851351525917352489409503",
                    "144061988706636402558768404894912910334",
                    "41760460526846914834539055097268522056",
                    "217374216991786881450675361491312209781",
                    "225644844904599433382574625748327210592",
                    "219175678001011742897453467129161423646",
                    "30139704971926640026947382836746770209",
                    "95812968352273376806464443778732007624",
                    "77724962621806154003135197500476925505",
                    "46971978458351870710934734332626456525",
                    "300287229516224976768868830287488887905",
                    "81397289336380612045933358636925899154"
                ]
            },
            "id": "PUB-A-215912712-abe1c2f6",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java"
            },
            "signature_type": "Line"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 1363.0,
                "function_hash": "173568828509927570143806274639106458779"
            },
            "id": "PUB-A-215912712-b1bd0d79",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "core/java/android/view/WindowlessWindowManager.java",
                "function": "addToDisplay"
            },
            "signature_type": "Function"
        },
        {
            "match_only_versions": [
                "12L-next"
            ],
            "digest": {
                "length": 248.0,
                "function_hash": "267065823521529045684033885819322014145"
            },
            "id": "PUB-A-215912712-c0217053",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "services/core/java/com/android/server/wm/EmbeddedWindowController.java",
                "function": "remove"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"
    ],
    "spl": "2022-06-01",
    "severity": "Moderate",
    "types": [
        "EoP"
    ]
}