{"id":"ASB-A-185810717","details":"In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-185810717","CVE-2021-39696"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2022-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/6ae9525c7fd6d72834be28298d836d8f30c0120c"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/c668064c04be23384a02cc404e49c6261e76e21f"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-08-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2022-08-01","types":["EoP"],"severity":"High","vanir_signatures":[{"target":{"function":"updateTaskDescription","file":"services/core/java/com/android/server/wm/TaskRecord.java"},"signature_version":"v1","id":"ASB-A-185810717-18dd2717","source":"https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec","signature_type":"Function","digest":{"length":1697,"function_hash":"114249753329107087525391617389938837229"},"deprecated":false},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/TaskRecord.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec","signature_version":"v1","id":"ASB-A-185810717-401f52e3","signature_type":"Function","digest":{"length":188,"function_hash":"62019064814636103343664505072038970591"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/wm/TaskRecord.java"},"signature_version":"v1","id":"ASB-A-185810717-63a41aa7","source":"https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["30360541158541498531301756461858228202","3514164200356127184443281256543517324","156036005671822800397929965898971209882","40932554667166922836237017915543376523","291904945844506897884815895668139604083","102723793227783992674986099692445639340","258841496115491640405859192614166378335","183077281465461956233309633883556334568","295423418368279808382593190180421323910","37161111418155250775281148592579906163","50833405293117833279415935327022836630","138014922861602889885975517389690195226","252063939245601009146420462652573004020","339733656564648532702095189611842122394","34479264088719289698657397483948250011","236802627812529280341923007124956661938","133153876722754042077793862079581596582","251789395544594388926596920568489929042","62003219187718509093994587176542682893","54700797171610032591371120809388323223","222189884300879595813186476941217263398","176060237286998589155617803537211818495","270430745615343053950386888560668369758","83333480928160377198890704101406992375","72900625664743943506835128900318134880","54737755366401656817833916192087562946","68700392199755740678690698967609718529","12999593050953470861858369245350678094","205843455455341981996900983496815805046","104354163961701047805843948492739466768","131726437111566703208411867857732469803","323045736658015902952337602168969264518","219610675203985275730562048953214720054","336183370629074514338328775332098232682","144929111754066236071393533552665001206","52237475449065380491226544910851728974","263420766519400170252950440108882399945","84357180193666935567022253850383057811","148662239779904816260159534483958622448","231085951127056114188229272483847737783","286244540789519161386871161485334670571","41146210076656651251647344028780213285","49238975494241385451681588626869753064","247450066453139465086866621600444130586","328032100225726135103140968243823755546"]},"deprecated":false},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/TaskRecord.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec","signature_version":"v1","id":"ASB-A-185810717-ea25479b","signature_type":"Function","digest":{"length":2097,"function_hash":"310692813872728003298386454620585542072"},"deprecated":false},{"target":{"function":"findEffectiveRootIndex","file":"services/core/java/com/android/server/wm/TaskRecord.java"},"id":"ASB-A-185810717-f90e595e","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec","signature_type":"Function","digest":{"length":330,"function_hash":"8782411516555310003248883134178163591"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cd1f9e72cf9752c9a31e990822ab34ae3d475fec"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-185810717.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-08-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-08-01","types":["EoP"],"severity":"High","vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/Task.java"},"signature_type":"Line","id":"ASB-A-185810717-0b366929","source":"https://android.googlesource.com/platform/frameworks/base/+/c5aaf99df5656fde68a4aaf2801fe30b0f5e44ae","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["52595531883840164852486254551178876795","154062033777965420023310222039535300906","262569442894312989936857751120848020609","74661298110234276737496755581400151879","297058171381607430058513335385694073661","42324559335298679099023454069409252154","14057519644253320131840377833787113601","148956871793272930027126321071786471301","273501821027985886128103485821024605584","104191343101939331533767672701237649596","28930306529248088288761223068953048148","331434379975274989704032711985558570991","141446953136170541669863070774974127006","279908319037663914224815648926905417944","47765870511665856545470235716616919474","185695585190966584225455543563284580414","110113713064953918238505665971822408524","317295907264898612408862227631009760426","206076769427817003270205358177470286269","166623853546666804376003782511857093807","121424296394949635876442572798478371883"]},"deprecated":false},{"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/c5aaf99df5656fde68a4aaf2801fe30b0f5e44ae","signature_version":"v1","id":"ASB-A-185810717-3b0447c2","signature_type":"Function","digest":{"length":2390,"function_hash":"212709493541495812727960142275378253451"},"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"}},{"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_version":"v1","id":"ASB-A-185810717-40061e86","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["308552683213346870058688407294738668298","278716541481851296818841190286809426677","315761850000771438408633455162439727858","167299014211513934606048582938306035617"]},"target":{"file":"services/core/java/com/android/server/wm/LaunchParamsPersister.java"}},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"},"signature_version":"v1","id":"ASB-A-185810717-65afdba9","source":"https://android.googlesource.com/platform/frameworks/base/+/c5aaf99df5656fde68a4aaf2801fe30b0f5e44ae","signature_type":"Function","digest":{"length":787,"function_hash":"103009817535832037988649160498157209401"},"deprecated":false},{"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_version":"v1","id":"ASB-A-185810717-84f9e293","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["270267953656468438518563010163479801018","113689335942243225269370079443296225165","56574999981327346990439269239635968344","255760020223444401083937830647181095557","95312432404155446654344847206999726902","234205518186457803052450179824608321220","210501686425343537950874358343699266995","88380941902565113212907298595913992897","268774905517820627813214429034184272535","202849182357323347719366141825897807845","337987487053846119195264261911490400658","202870691787698768385066861407014432964","101486682895096704713854736964085283199","77888250498156048942380498913764368822","231648317017581035471595418148087572272","67858898552590349168156722563153956211","148558139831752693360995294971830589149","166798505782220541920039972027162052772","74196875491008610533364407704394809790","8129973408310764468139125785590461044","74661298110234276737496755581400151879","297058171381607430058513335385694073661","42324559335298679099023454069409252154","14057519644253320131840377833787113601","148956871793272930027126321071786471301","127159712984520244076913140424508851741","284162875520143767686284517147922809629","141446953136170541669863070774974127006","117622921226904855528179967496546268483","69133172342198953785305958677470613644","73073340269886335719511329704359111918","127957146646921559588792381572624453136","196525442180716213461374868019562642117","54700797171610032591371120809388323223","222189884300879595813186476941217263398","176060237286998589155617803537211818495","270430745615343053950386888560668369758"]},"target":{"file":"services/core/java/com/android/server/wm/Task.java"}},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"},"id":"ASB-A-185810717-98e4ac28","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_type":"Function","digest":{"length":483,"function_hash":"244755902879353845954371395257098414906"},"deprecated":false},{"target":{"function":"processActivity","file":"services/core/java/com/android/server/wm/Task.java"},"id":"ASB-A-185810717-a5fc2c6b","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_type":"Function","digest":{"length":248,"function_hash":"93310086254095991867519117253775860515"},"deprecated":false},{"target":{"function":"saveTask","file":"services/core/java/com/android/server/wm/LaunchParamsPersister.java"},"id":"ASB-A-185810717-e09a9950","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_type":"Function","digest":{"length":538,"function_hash":"299749214242481983182204029661073510566"},"deprecated":false},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","signature_version":"v1","id":"ASB-A-185810717-e46620cc","signature_type":"Function","digest":{"length":2323,"function_hash":"113519283436401956857457209946164661682"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7221a25a035bc7397492e15460b40395efce7023","https://android.googlesource.com/platform/frameworks/base/+/c5aaf99df5656fde68a4aaf2801fe30b0f5e44ae"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-185810717.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-08-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/339f4ca753b3ecf3bac520e8d70541a7223fb7c2"],"types":["EoP"],"severity":"High","vanir_signatures":[{"target":{"function":"processActivity","file":"services/core/java/com/android/server/wm/Task.java"},"signature_type":"Function","id":"ASB-A-185810717-31ab5915","source":"https://android.googlesource.com/platform/frameworks/base/+/339f4ca753b3ecf3bac520e8d70541a7223fb7c2","signature_version":"v1","digest":{"length":248,"function_hash":"93310086254095991867519117253775860515"},"deprecated":false},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/339f4ca753b3ecf3bac520e8d70541a7223fb7c2","signature_version":"v1","id":"ASB-A-185810717-61c733b9","signature_type":"Function","digest":{"length":409,"function_hash":"303421974648205830524305549598901999292"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/wm/Task.java"},"id":"ASB-A-185810717-a85ce500","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/339f4ca753b3ecf3bac520e8d70541a7223fb7c2","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["176977018547643727165555349925919150112","61273032671010555112067042498848993705","210952737140323125617952079181036189101","63638498230607656154402415079115304945","238975493386478583003188720778095227941","324851195226224905193267755883425278878","70551364984156456703525134292317396185","88380941902565113212907298595913992897","268774905517820627813214429034184272535","202849182357323347719366141825897807845","337987487053846119195264261911490400658","202870691787698768385066861407014432964","243945114704921271115249838784025814286","276707104677153373588836404732608918917","272283132870058892448415143441713351837","18577647923828561894255092725633003720","67858898552590349168156722563153956211","336127415114684718460904837652194315614","318534229968897798837508631791009361356","161614524541539143309079290724643929727","42651205751565668215105703900885047507","54700797171610032591371120809388323223","222189884300879595813186476941217263398","176060237286998589155617803537211818495","270430745615343053950386888560668369758"]},"deprecated":false},{"target":{"function":"setIntent","file":"services/core/java/com/android/server/wm/Task.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/339f4ca753b3ecf3bac520e8d70541a7223fb7c2","signature_version":"v1","id":"ASB-A-185810717-f2e6d6f4","signature_type":"Function","digest":{"length":2203,"function_hash":"332131789057311100416810362742688402519"},"deprecated":false}],"spl":"2022-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-185810717.json"}}],"schema_version":"1.7.5"}