{"id":"ASB-A-158484422","details":"In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-158484422","CVE-2020-0468"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2020-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-12-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"227592950619444073236834675384847989594","length":838},"id":"ASB-A-158484422-03e7429d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"notifyCellLocationForSubscriber"}},{"digest":{"length":4116,"function_hash":"98545911076840422893492015795779883073"},"id":"ASB-A-158484422-11f47cf7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"checkPossibleMissNotify"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"notifyCellInfoForSubscriber"},"deprecated":false,"digest":{"function_hash":"14403077765341471219237388904833425996","length":756},"id":"ASB-A-158484422-277605a6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"},{"target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"listen"},"deprecated":false,"digest":{"function_hash":"278230054623382886440329610869016050348","length":8295},"id":"ASB-A-158484422-2af8719f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"},{"id":"ASB-A-158484422-39a1b939","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"checkListenerPermission"},"deprecated":false,"digest":{"length":1776,"function_hash":"90452387300163781628008247118808005590"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java"},"deprecated":false,"digest":{"line_hashes":["10943827363142658388210780430556738230","238110965093245124675685035294314365839","31091712905061448407325351105768141115","201507465943739065002815137910854406692","250003175213959155292028663982283958281","178773806954714138744138982139504969872","57044500312732327786982912104067219667","319834494490701677330713155223139020981","279426901184886979546545763894857073585","303297080388188663343941540804600543082","261394730551617673396712692884388698146","180520665114383320219736569874426954821","1784963530633295404568663810016826580","119884402732264601068828642599539185618","63981835964096879928595961085571453382","271222105085836384058704930009915978111","150736193762010748021559462126611155489","266911201449728256297362856223327366420","181126822532097373944488355266371694217","192511923253641100290408216862802145811","153646901353188742568683597496766679236","322343017312916405282403958571542590622","229771284142526068774418756495446375314","40039738705475081582237730672844515004","153646901353188742568683597496766679236","158435167438662793387061249103126918400","255202982643100122317599393330103568622","162509902026563919286360318487425742840","153909623343255956999281724897293827395","68606885823137607329836910493928990545","305467694650431979073392647011401207570","112075859767269360257293419637927003074","298994257123229988811531148032976363791","210520666768879077496692420622853462346","114290584686377765100878681721865678527","288358516052996599164838194939854843559","57947860777357811107703632212922723461","163734138395586954539298689748969943452","298941800025855985827484045296297213763","134704085158062611334459049023132528982","225463704808931563203173407622104234007","132190804428168890173085546433230354213","49832184369875333780599027789228612884","253264445617024624304020408706809779716","228532535161781666034246255225423196424","77072687037716129602945793041361051211","52149698541181835134172981359598042033","266911201449728256297362856223327366420","140954152111276697876106697340549724483","181606215248780791283708572192641407428","290172819216276124966607943739048794131","119884402732264601068828642599539185618"],"threshold":0.9},"id":"ASB-A-158484422-419f7d25"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"],"severity":"High","spl":"2020-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-158484422.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-12-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","spl":"2020-12-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"notifyCellInfoForSubscriber"},"deprecated":false,"digest":{"function_hash":"14403077765341471219237388904833425996","length":756},"id":"ASB-A-158484422-0275c11d"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["10943827363142658388210780430556738230","238110965093245124675685035294314365839","31091712905061448407325351105768141115","201507465943739065002815137910854406692","250003175213959155292028663982283958281","178773806954714138744138982139504969872","57044500312732327786982912104067219667","319834494490701677330713155223139020981","279426901184886979546545763894857073585","303297080388188663343941540804600543082","261394730551617673396712692884388698146","180520665114383320219736569874426954821","1784963530633295404568663810016826580","119884402732264601068828642599539185618","63981835964096879928595961085571453382","271222105085836384058704930009915978111","150736193762010748021559462126611155489","266911201449728256297362856223327366420","181126822532097373944488355266371694217","192511923253641100290408216862802145811","153646901353188742568683597496766679236","322343017312916405282403958571542590622","229771284142526068774418756495446375314","40039738705475081582237730672844515004","153646901353188742568683597496766679236","158435167438662793387061249103126918400","255202982643100122317599393330103568622","162509902026563919286360318487425742840","153909623343255956999281724897293827395","68606885823137607329836910493928990545","305467694650431979073392647011401207570","112075859767269360257293419637927003074","298994257123229988811531148032976363791","210520666768879077496692420622853462346","114290584686377765100878681721865678527","288358516052996599164838194939854843559","57947860777357811107703632212922723461","163734138395586954539298689748969943452","298941800025855985827484045296297213763","134704085158062611334459049023132528982","225463704808931563203173407622104234007","132190804428168890173085546433230354213","49832184369875333780599027789228612884","253264445617024624304020408706809779716","228532535161781666034246255225423196424","77072687037716129602945793041361051211","52149698541181835134172981359598042033","266911201449728256297362856223327366420","140954152111276697876106697340549724483","181606215248780791283708572192641407428","290172819216276124966607943739048794131","119884402732264601068828642599539185618"]},"id":"ASB-A-158484422-0378c2ac"},{"deprecated":false,"digest":{"function_hash":"90452387300163781628008247118808005590","length":1776},"id":"ASB-A-158484422-27bd6793","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"checkListenerPermission"}},{"deprecated":false,"digest":{"function_hash":"278230054623382886440329610869016050348","length":8295},"id":"ASB-A-158484422-403e2e25","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java","function":"listen"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"function":"notifyCellLocationForSubscriber","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"deprecated":false,"digest":{"length":838,"function_hash":"227592950619444073236834675384847989594"},"id":"ASB-A-158484422-53f4b65f","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","target":{"function":"checkPossibleMissNotify","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"deprecated":false,"digest":{"function_hash":"98545911076840422893492015795779883073","length":4116},"id":"ASB-A-158484422-6c7e69f1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-158484422.json"}}],"schema_version":"1.9.0"}