{"id":"ASB-A-158484422","details":"In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-158484422","CVE-2020-0468"],"modified":"2026-06-12T15:08:17.296522730Z","published":"2020-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-12-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["ID"],"severity":"High","vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","id":"ASB-A-158484422-03e7429d","signature_version":"v1","target":{"function":"notifyCellLocationForSubscriber","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"digest":{"function_hash":"227592950619444073236834675384847989594","length":838},"signature_type":"Function","deprecated":false},{"digest":{"function_hash":"98545911076840422893492015795779883073","length":4116},"id":"ASB-A-158484422-11f47cf7","target":{"function":"checkPossibleMissNotify","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","deprecated":false,"signature_type":"Function"},{"target":{"function":"notifyCellInfoForSubscriber","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"id":"ASB-A-158484422-277605a6","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_version":"v1","digest":{"function_hash":"14403077765341471219237388904833425996","length":756},"signature_type":"Function","deprecated":false},{"digest":{"function_hash":"278230054623382886440329610869016050348","length":8295},"id":"ASB-A-158484422-2af8719f","target":{"function":"listen","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","deprecated":false,"signature_type":"Function"},{"target":{"function":"checkListenerPermission","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"id":"ASB-A-158484422-39a1b939","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_version":"v1","digest":{"function_hash":"90452387300163781628008247118808005590","length":1776},"signature_type":"Function","deprecated":false},{"digest":{"line_hashes":["10943827363142658388210780430556738230","238110965093245124675685035294314365839","31091712905061448407325351105768141115","201507465943739065002815137910854406692","250003175213959155292028663982283958281","178773806954714138744138982139504969872","57044500312732327786982912104067219667","319834494490701677330713155223139020981","279426901184886979546545763894857073585","303297080388188663343941540804600543082","261394730551617673396712692884388698146","180520665114383320219736569874426954821","1784963530633295404568663810016826580","119884402732264601068828642599539185618","63981835964096879928595961085571453382","271222105085836384058704930009915978111","150736193762010748021559462126611155489","266911201449728256297362856223327366420","181126822532097373944488355266371694217","192511923253641100290408216862802145811","153646901353188742568683597496766679236","322343017312916405282403958571542590622","229771284142526068774418756495446375314","40039738705475081582237730672844515004","153646901353188742568683597496766679236","158435167438662793387061249103126918400","255202982643100122317599393330103568622","162509902026563919286360318487425742840","153909623343255956999281724897293827395","68606885823137607329836910493928990545","305467694650431979073392647011401207570","112075859767269360257293419637927003074","298994257123229988811531148032976363791","210520666768879077496692420622853462346","114290584686377765100878681721865678527","288358516052996599164838194939854843559","57947860777357811107703632212922723461","163734138395586954539298689748969943452","298941800025855985827484045296297213763","134704085158062611334459049023132528982","225463704808931563203173407622104234007","132190804428168890173085546433230354213","49832184369875333780599027789228612884","253264445617024624304020408706809779716","228532535161781666034246255225423196424","77072687037716129602945793041361051211","52149698541181835134172981359598042033","266911201449728256297362856223327366420","140954152111276697876106697340549724483","181606215248780791283708572192641407428","290172819216276124966607943739048794131","119884402732264601068828642599539185618"],"threshold":0.9},"id":"ASB-A-158484422-419f7d25","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","deprecated":false,"signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"],"spl":"2020-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-158484422.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-12-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["ID"],"spl":"2020-12-01","vanir_signatures":[{"target":{"function":"notifyCellInfoForSubscriber","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"id":"ASB-A-158484422-0275c11d","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_version":"v1","digest":{"function_hash":"14403077765341471219237388904833425996","length":756},"deprecated":false,"signature_type":"Function"},{"digest":{"line_hashes":["10943827363142658388210780430556738230","238110965093245124675685035294314365839","31091712905061448407325351105768141115","201507465943739065002815137910854406692","250003175213959155292028663982283958281","178773806954714138744138982139504969872","57044500312732327786982912104067219667","319834494490701677330713155223139020981","279426901184886979546545763894857073585","303297080388188663343941540804600543082","261394730551617673396712692884388698146","180520665114383320219736569874426954821","1784963530633295404568663810016826580","119884402732264601068828642599539185618","63981835964096879928595961085571453382","271222105085836384058704930009915978111","150736193762010748021559462126611155489","266911201449728256297362856223327366420","181126822532097373944488355266371694217","192511923253641100290408216862802145811","153646901353188742568683597496766679236","322343017312916405282403958571542590622","229771284142526068774418756495446375314","40039738705475081582237730672844515004","153646901353188742568683597496766679236","158435167438662793387061249103126918400","255202982643100122317599393330103568622","162509902026563919286360318487425742840","153909623343255956999281724897293827395","68606885823137607329836910493928990545","305467694650431979073392647011401207570","112075859767269360257293419637927003074","298994257123229988811531148032976363791","210520666768879077496692420622853462346","114290584686377765100878681721865678527","288358516052996599164838194939854843559","57947860777357811107703632212922723461","163734138395586954539298689748969943452","298941800025855985827484045296297213763","134704085158062611334459049023132528982","225463704808931563203173407622104234007","132190804428168890173085546433230354213","49832184369875333780599027789228612884","253264445617024624304020408706809779716","228532535161781666034246255225423196424","77072687037716129602945793041361051211","52149698541181835134172981359598042033","266911201449728256297362856223327366420","140954152111276697876106697340549724483","181606215248780791283708572192641407428","290172819216276124966607943739048794131","119884402732264601068828642599539185618"],"threshold":0.9},"id":"ASB-A-158484422-0378c2ac","target":{"file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_type":"Line","deprecated":false},{"signature_version":"v1","id":"ASB-A-158484422-27bd6793","digest":{"function_hash":"90452387300163781628008247118808005590","length":1776},"target":{"function":"checkListenerPermission","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_type":"Function","deprecated":false},{"digest":{"function_hash":"278230054623382886440329610869016050348","length":8295},"id":"ASB-A-158484422-403e2e25","target":{"function":"listen","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_type":"Function","deprecated":false},{"digest":{"function_hash":"227592950619444073236834675384847989594","length":838},"id":"ASB-A-158484422-53f4b65f","target":{"function":"notifyCellLocationForSubscriber","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","deprecated":false,"signature_type":"Function"},{"target":{"function":"checkPossibleMissNotify","file":"services/core/java/com/android/server/TelephonyRegistry.java"},"id":"ASB-A-158484422-6c7e69f1","source":"https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe","signature_version":"v1","digest":{"function_hash":"98545911076840422893492015795779883073","length":4116},"signature_type":"Function","deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/af35aa5ac57a8c7c4534d82d8cd6cfb4f049bbfe"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-158484422.json"}}],"schema_version":"1.7.5"}