PUB-A-236264289

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-236264289.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-236264289
Aliases
  • A-236264289
  • CVE-2022-20558
Published
2022-12-01T00:00:00Z
Modified
2025-11-05T16:30:26.460762Z
Summary
[none]
Details

In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/opt/net/ims

Package

Name
platform/frameworks/opt/net/ims

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2022-12-01

Affected versions

Other

13

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "severity": "Moderate",
    "spl": "2022-12-01",
    "vanir_signatures": [
        {
            "match_only_versions": [
                "13"
            ],
            "source": "https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "17360799293048442066505985161950929115",
                    "328368001886009224069484841306278194830",
                    "99953689535948755601997894374607517785",
                    "195233620726160135965610573385735531249"
                ]
            },
            "deprecated": false,
            "id": "PUB-A-236264289-12f945c0",
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "src/java/com/android/ims/rcs/uce/presence/publish/DeviceCapabilityListener.java"
            }
        },
        {
            "match_only_versions": [
                "13"
            ],
            "source": "https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "162282707822528203542231119936839344072",
                    "23802815394259780986893727447244734264",
                    "52943098920708217744766365953400819717",
                    "87354709219545991944421374570804310995",
                    "332861751766177842396881569501310283291",
                    "133614099957187829240276545199366750583",
                    "221262851186960587110234639373538289996",
                    "255958958686956559658407877499037658582"
                ]
            },
            "deprecated": false,
            "id": "PUB-A-236264289-3e1953b5",
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "tests/src/com/android/ims/ContextFixture.java"
            }
        },
        {
            "match_only_versions": [
                "13"
            ],
            "source": "https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2",
            "digest": {
                "function_hash": "229801768736183275224950774434043203122",
                "length": 506.0
            },
            "deprecated": false,
            "id": "PUB-A-236264289-dbce3c83",
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "function": "registerReceivers",
                "file": "src/java/com/android/ims/rcs/uce/presence/publish/DeviceCapabilityListener.java"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2"
    ]
}