PUB-A-238602879

See a problem?

Import Source

https://storage.googleapis.com/android-osv/PUB-A-238602879.json

JSON Data

https://api.osv.dev/v1/vulns/PUB-A-238602879

Aliases

A-238602879
CVE-2022-20512

Published

2022-12-01T00:00:00Z

Modified

2026-09-14T15:29:34Z

Summary

[none]

Details

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2022-12-01

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13:0

Fixed

13:2022-12-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10"
    ],
    "severity": "Moderate",
    "spl": "2022-12-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "87023234758636688518580279742977847492",
                    "156227951408008149834809767716402724201",
                    "139538904288499720733161739059871245162",
                    "17906862208350683992250854401296033418",
                    "18570516621411759979227798673153229010",
                    "62939044643125166266960321315167273467",
                    "325506342793831268866187749169094700697",
                    "128557412904820919273039029231580412176",
                    "53298215061424404130679366970089834771",
                    "237293726578278862743492198370101092423",
                    "338938134932563759249131400322763920224",
                    "25420170227652838024166694697780244688",
                    "88372360178374856683271211677692117338",
                    "290662778995779118785300837761397747970",
                    "132350304773521846314295717061613364331",
                    "328504435574437078211190151648417571967",
                    "122781516842314321148626743446737549504",
                    "214483010262324132343025915366814790676",
                    "52168654157603053583445468678094860297",
                    "12529517412027992795308357350496645327",
                    "43910844674588589681746577153810251861",
                    "328071507593102006017421473658828670766",
                    "167036411047712391975502344021954460322",
                    "276223985194962337881169963514332698391",
                    "60398313064302945078369980694065506932",
                    "198717170560423248128880402600788625734",
                    "5812219054698407678957203650405056987",
                    "15374866258333306775744673837346384118",
                    "319632001533401223903935507899340528659"
                ],
                "threshold": 0.9
            },
            "id": "PUB-A-238602879-32c625b9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "services/core/java/com/android/server/wm/Task.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "306559393022413925382155773692320296384",
                    "238960534496907325979934580275291698422",
                    "169188590464448337574821319562833570629",
                    "78745171192634581654606904275711492068",
                    "53788038157245073677564316840809908521"
                ],
                "threshold": 0.9
            },
            "id": "PUB-A-238602879-3b26aeba",
            "match_only_versions": [
                "13"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "core/java/android/app/Activity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "282781627699296836975327025386161346934",
                    "42094766961544345880972979640642786933",
                    "250550536400353281549849636313870821883",
                    "290482630999081124066155995341611557341",
                    "236854611551494729720537003077808950778",
                    "120524270434374463572634767311078181470",
                    "162774942616731393439321803859546688995",
                    "249567687540557912646933735048079729022"
                ],
                "threshold": 0.9
            },
            "id": "PUB-A-238602879-4c43d792",
            "match_only_versions": [
                "13"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "core/java/android/app/ActivityClient.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "91395776182192251487408040872637904378",
                "length": 558
            },
            "id": "PUB-A-238602879-6431ec59",
            "match_only_versions": [
                "13"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "core/java/android/app/Activity.java",
                "function": "navigateUpTo"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "307238130757706282620781154472359191247",
                "length": 2999
            },
            "id": "PUB-A-238602879-8eb4c0c3",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "services/core/java/com/android/server/wm/Task.java",
                "function": "navigateUpTo"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "43236168583164607272166184699747538749",
                    "112539726971416951003819936074542494816",
                    "11679931484379987831102043081266917436",
                    "96198931258405865349890283898157425465",
                    "247847563746743205079531358196549504093",
                    "211702326257149068260973419647808809405",
                    "128223971925101955697380962639458389835",
                    "70871824146377541733704190391174489597",
                    "119710023312408707206073918279139011674"
                ],
                "threshold": 0.9
            },
            "id": "PUB-A-238602879-8f426356",
            "match_only_versions": [
                "13"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityClientController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "206418071082596740030823545870001781072",
                "length": 439
            },
            "id": "PUB-A-238602879-f440e919",
            "match_only_versions": [
                "13"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityClientController.java",
                "function": "navigateUpTo"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/PUB-A-238602879.json"