{"id":"ASB-A-203431023","details":"In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.","aliases":["A-203431023","CVE-2022-20126"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","id":"ASB-A-203431023-0564ff75","digest":{"function_hash":"306408796174320226647143357411811607888","length":297}},{"deprecated":false,"signature_version":"v1","signature_type":"Line","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","id":"ASB-A-203431023-0f43b4af","digest":{"threshold":0.9,"line_hashes":["184196211465596637036676436981022160986","310663038790803474228144224051457634065","235200042516890789000893520623616856433","74056111292228662419642069507111208323","280865106268737356318352464790165724163","31751067178526632610812621753358219135","121380037984780544106085503251813162023","115406219874387320131559651200307225012","202006277810136237772203677493381325889","184997035097119368774453889288419654155","228403452926252819945841653792026404095","79357729360616193902807655643700292302","53073610528342643939637634752102331140","233298843227634921828128355666204684003","129041647635244075524337653918275144826","201497200635376658514585156517811832238","299108017017304219847357040897943149945","26336067661531312286298575742099149644","216431135408102165191893687207576056864","176281420003676838415340115292266963530","219325013445161890951510386503674400884","231031870505611136751596413830225061327","73397768373368757536479802789304542650","86297380719523360092289164958136849650","96504084766857505299204479415726309676","160057590753693384341480522250881637743","1133394177015753540700299389162097589","252693157415961571234960786732231294635","325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653","259482035435254778313450921017276894325"]}},{"deprecated":false,"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"337355188220726876884449145526534949697","length":273},"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"getDiscoverableTimeout"},"id":"ASB-A-203431023-57193b34"},{"deprecated":false,"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"224398954382340583561811694483425651957","length":350},"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"setScanMode"},"id":"ASB-A-203431023-da1724b4"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558"],"types":["EoP"],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-203431023.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-06-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"signature_version":"v1","signature_type":"Line","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0","id":"ASB-A-203431023-7888c779","digest":{"threshold":0.9,"line_hashes":["236829967481794875659806067643400471350","221889625477845835155469983470567822437","318959092762556263064621329974291824841","108872696766585779850438660990602331717"]}},{"deprecated":false,"signature_version":"v1","signature_type":"Function","id":"ASB-A-203431023-a11e83cd","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setScanMode"},"digest":{"function_hash":"339203127178591143702063251470082974776","length":209}}],"spl":"2022-06-01","severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-203431023.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-06-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"signature_version":"v1","signature_type":"Line","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/649612a49791564b43e6f5d41cb4a5ae07d94394","id":"ASB-A-203431023-a5b6da18","digest":{"threshold":0.9,"line_hashes":["284189501339935948702336696034543302981","20429472355090212643904629645984168325","92254625992077032004077375276068304370","310656572878670007030099036643950233342"]}}],"types":["EoP"],"spl":"2022-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/649612a49791564b43e6f5d41cb4a5ae07d94394"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-203431023.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-06-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"match_only_versions":["12"],"id":"ASB-A-203431023-9bd93427","digest":{"threshold":0.9,"line_hashes":["115406219874387320131559651200307225012","202006277810136237772203677493381325889","184997035097119368774453889288419654155"]},"deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"},{"signature_version":"v1","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setScanMode"},"match_only_versions":["12"],"id":"ASB-A-203431023-aa617f78","digest":{"function_hash":"224398954382340583561811694483425651957","length":350},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"}],"spl":"2022-06-01","severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-203431023.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"match_only_versions":["12L"],"digest":{"threshold":0.9,"line_hashes":["115406219874387320131559651200307225012","202006277810136237772203677493381325889","184997035097119368774453889288419654155"]},"id":"ASB-A-203431023-829ae564","deprecated":false,"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"},{"signature_version":"v1","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setScanMode"},"match_only_versions":["12L"],"id":"ASB-A-203431023-ff5778ad","digest":{"function_hash":"224398954382340583561811694483425651957","length":350},"deprecated":false,"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"],"types":["EoP"],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-203431023.json"}}],"schema_version":"1.7.5"}