{"id":"ASB-A-170646036","details":"In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-170646036","CVE-2022-20124"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/ae313d6d4082089798d067f318eb068cfb6bd15d"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-12-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7fdc96aef4e098d2271ac3a8557bd8e1ad6827f3","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-22dd373b","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a7621e0ce00f1d140b375518e26cf75693314203","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"201429292815245617374230375440999888000","length":3464},"id":"ASB-A-170646036-26500baa"},{"id":"ASB-A-170646036-33946b67","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/49d8f9325a8d103497632097010899f87f403faa","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"320352949280285539864513042256536044416","length":3818}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7fdc96aef4e098d2271ac3a8557bd8e1ad6827f3","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"201429292815245617374230375440999888000","length":3464},"id":"ASB-A-170646036-36ff0325","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/49d8f9325a8d103497632097010899f87f403faa","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["194082553904463856800599032293466712415","325466741585405983929497563812367825194","298448803795896996175377464937350806652","166615219856862908950441713590713400406","196017788875678769309945180639071486112","92765342030421872790715326249377630273","44650291620930001939615047464136769960","316431161103230271084133804382668924260","194986933683335083198048197738316623704","235506599002003822382877843285059729586","46766537416594621686106080346424757138","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-3d9d21bb","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a7621e0ce00f1d140b375518e26cf75693314203","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-8b04dd3e"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a7621e0ce00f1d140b375518e26cf75693314203","https://android.googlesource.com/platform/frameworks/base/+/49d8f9325a8d103497632097010899f87f403faa","https://android.googlesource.com/platform/frameworks/base/+/7fdc96aef4e098d2271ac3a8557bd8e1ad6827f3"],"severity":"High","spl":"2022-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170646036.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-12-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-390e6147","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"]},"id":"ASB-A-170646036-42ebc852","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"function":"deletePackageX","file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"function_hash":"247337414279009763130599702836113481980","length":3780},"id":"ASB-A-170646036-45eb38b5","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"94088287687142817538660519691282968563","length":3426},"id":"ASB-A-170646036-7261c508","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["194082553904463856800599032293466712415","314224056229181788922813607764940492886","29313994280375603394494746855469781729","81512619506987332127036764393828120990","265981881756136429085815561240242421512","92765342030421872790715326249377630273","44650291620930001939615047464136769960","316431161103230271084133804382668924260","194986933683335083198048197738316623704","235506599002003822382877843285059729586","46766537416594621686106080346424757138","37394677783888071540816239980752954286"]},"id":"ASB-A-170646036-b67f1e85"},{"id":"ASB-A-170646036-bd5d1ba4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"function":"deletePackageX","file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"length":3426,"function_hash":"94088287687142817538660519691282968563"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7"],"severity":"High","spl":"2022-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170646036.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"]},"id":"ASB-A-170646036-694df2b6"},{"id":"ASB-A-170646036-930f325a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"],"threshold":0.9}},{"digest":{"function_hash":"94088287687142817538660519691282968563","length":3426},"id":"ASB-A-170646036-d3f3851f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false},{"digest":{"function_hash":"247337414279009763130599702836113481980","length":3780},"id":"ASB-A-170646036-d5874206","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["194082553904463856800599032293466712415","314224056229181788922813607764940492886","29313994280375603394494746855469781729","81512619506987332127036764393828120990","265981881756136429085815561240242421512","92765342030421872790715326249377630273","44650291620930001939615047464136769960","316431161103230271084133804382668924260","194986933683335083198048197738316623704","235506599002003822382877843285059729586","46766537416594621686106080346424757138","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-df21fd0a","signature_type":"Line"},{"target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"94088287687142817538660519691282968563","length":3426},"id":"ASB-A-170646036-ee075ccf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7"],"severity":"High","spl":"2022-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170646036.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["194082553904463856800599032293466712415","314224056229181788922813607764940492886","29313994280375603394494746855469781729","81512619506987332127036764393828120990","265981881756136429085815561240242421512","92765342030421872790715326249377630273","44650291620930001939615047464136769960","316431161103230271084133804382668924260","194986933683335083198048197738316623704","235506599002003822382877843285059729586","46766537416594621686106080346424757138","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-20e3595d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false},{"digest":{"function_hash":"247337414279009763130599702836113481980","length":3780},"id":"ASB-A-170646036-71c0e2ba","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java","function":"deletePackageX"},"deprecated":false},{"deprecated":false,"digest":{"length":3426,"function_hash":"94088287687142817538660519691282968563"},"id":"ASB-A-170646036-8f8b9b23","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7","target":{"function":"deletePackageX","file":"services/core/java/com/android/server/pm/PackageManagerService.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"function":"deletePackageX","file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"length":3426,"function_hash":"94088287687142817538660519691282968563"},"id":"ASB-A-170646036-ba1539f5","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"]},"id":"ASB-A-170646036-fbbba21d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7","target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["127330503220437079710711639301429071750","48880012800817546858442601132270849394","37394677783888071540816239980752954286"],"threshold":0.9},"id":"ASB-A-170646036-ff43eb84"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6c870e157994519094e9e50ddf93e57a26779e22","https://android.googlesource.com/platform/frameworks/base/+/d9089fbe06e77f5ea1773f5d69b641a81e0b5832","https://android.googlesource.com/platform/frameworks/base/+/fbfa268d47c7915b7a87d3fef22a5b8f3bbabeb7"],"severity":"High","spl":"2022-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170646036.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/DeletePackageHelper.java","function":"deletePackageX"},"deprecated":false,"digest":{"function_hash":"288706182116642159784688675982850866504","length":5193},"id":"ASB-A-170646036-07c95f71","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae313d6d4082089798d067f318eb068cfb6bd15d"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/ae313d6d4082089798d067f318eb068cfb6bd15d","target":{"file":"services/core/java/com/android/server/pm/DeletePackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["29961735311844885679495198650580819690","257999338713085422075433887860710905561","270919010389292934355690033793767538111","125817520226217589535995184453029986355","167219488060220531447016492311677866674","15806488617926428166605879151555785900","166482812433908678057078835041569136733"],"threshold":0.9},"id":"ASB-A-170646036-6850eb37","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-170646036-844648d1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bbe5294adad72be7a838ff5962554325ac65809b","target":{"file":"services/core/java/com/android/server/pm/DeletePackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["269410722626483146478067899420535307537","72564865425525203037491701968470373659","91180626677782766062408040908031772745","102603560758670707118326068068444470039","329738760646166792193941896194838679068","186025139228974346031814435587195868198","52707718883075094081210769665256414729","20088188489375509799777521058113229932","207794948539591998527934614670375468922","161644933012468610622785550715275958767","228775226033846879179679615327872458770","280603449317954856548187963217422003325","226131422305889470123671584979903649878","194986933683335083198048197738316623704","153492668186190904122345280920986245923","10857837018305112896242021845072968173","166482812433908678057078835041569136733"],"threshold":0.9}},{"deprecated":false,"digest":{"length":5705,"function_hash":"17651826466171379423327113956604941076"},"id":"ASB-A-170646036-b46020f9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bbe5294adad72be7a838ff5962554325ac65809b","target":{"file":"services/core/java/com/android/server/pm/DeletePackageHelper.java","function":"deletePackageX"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bbe5294adad72be7a838ff5962554325ac65809b","https://android.googlesource.com/platform/frameworks/base/+/ae313d6d4082089798d067f318eb068cfb6bd15d"],"severity":"High","spl":"2022-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-170646036.json"}}],"schema_version":"1.9.0"}