ASB-A-223578534

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-223578534.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-223578534
Aliases
  • A-223578534
  • CVE-2022-20223
Published
2022-07-01T00:00:00Z
Modified
2024-08-07T19:29:57.382209Z
Summary
EoP: Unsafe package check leading to LaunchAnyWhere in AppRestrictionsFragment
Details

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10:0
Fixed
10:2022-07-01

Affected versions

Other

10

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 489.0,
                "function_hash": "230728443153871352391391556050698896647"
            },
            "id": "ASB-A-223578534-bd2fef27",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b3eecdd13d9f3d9fde99e9881c9e451ff199f7ad",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "232477022807444841013375170475551310078",
                    "146625305168494414691894218653073493704",
                    "109457721975710769064585912225534305770",
                    "42352054353086035454349671191144762807",
                    "284514082129184479650462996686183383481",
                    "33376965427845241378269936173562622954"
                ]
            },
            "id": "ASB-A-223578534-f098c976",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/b3eecdd13d9f3d9fde99e9881c9e451ff199f7ad",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/b3eecdd13d9f3d9fde99e9881c9e451ff199f7ad"
    ],
    "spl": "2022-07-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11:0
Fixed
11:2022-07-01

Affected versions

Other

11

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 489.0,
                "function_hash": "230728443153871352391391556050698896647"
            },
            "id": "ASB-A-223578534-70caad6e",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/aeb36e5c282ac9cdfb34e87f68b8d8a5067d644d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "232477022807444841013375170475551310078",
                    "146625305168494414691894218653073493704",
                    "109457721975710769064585912225534305770",
                    "42352054353086035454349671191144762807",
                    "284514082129184479650462996686183383481",
                    "33376965427845241378269936173562622954"
                ]
            },
            "id": "ASB-A-223578534-afaf5a70",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/aeb36e5c282ac9cdfb34e87f68b8d8a5067d644d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/aeb36e5c282ac9cdfb34e87f68b8d8a5067d644d"
    ],
    "spl": "2022-07-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12:0
Fixed
12:2022-07-01

Affected versions

Other

12

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "232477022807444841013375170475551310078",
                    "146625305168494414691894218653073493704",
                    "109457721975710769064585912225534305770",
                    "42352054353086035454349671191144762807",
                    "284514082129184479650462996686183383481",
                    "33376965427845241378269936173562622954"
                ]
            },
            "id": "ASB-A-223578534-0b473dfc",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/f8f45888e6d20b238b222b95d18898fa1ab81ed4",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 489.0,
                "function_hash": "230728443153871352391391556050698896647"
            },
            "id": "ASB-A-223578534-5f63e23f",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/f8f45888e6d20b238b222b95d18898fa1ab81ed4",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/f8f45888e6d20b238b222b95d18898fa1ab81ed4"
    ],
    "spl": "2022-07-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}

Android / platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12L:0
Fixed
12L:2022-07-01

Affected versions

Other

12L

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "length": 489.0,
                "function_hash": "230728443153871352391391556050698896647"
            },
            "id": "ASB-A-223578534-6ba22492",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/019eb77224b0671458ad447f15a2a29935c866c6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "232477022807444841013375170475551310078",
                    "146625305168494414691894218653073493704",
                    "109457721975710769064585912225534305770",
                    "42352054353086035454349671191144762807",
                    "284514082129184479650462996686183383481",
                    "33376965427845241378269936173562622954"
                ]
            },
            "id": "ASB-A-223578534-cc55d9bd",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/019eb77224b0671458ad447f15a2a29935c866c6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            },
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/019eb77224b0671458ad447f15a2a29935c866c6"
    ],
    "spl": "2022-07-01",
    "severity": "High",
    "types": [
        "EoP"
    ]
}