{"id":"ASB-A-206807679","details":"In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-206807679","CVE-2022-20133"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"deprecated":false,"digest":{"function_hash":"306408796174320226647143357411811607888","length":297},"id":"ASB-A-206807679-0564ff75","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["184196211465596637036676436981022160986","310663038790803474228144224051457634065","235200042516890789000893520623616856433","74056111292228662419642069507111208323","280865106268737356318352464790165724163","31751067178526632610812621753358219135","121380037984780544106085503251813162023","115406219874387320131559651200307225012","202006277810136237772203677493381325889","184997035097119368774453889288419654155","228403452926252819945841653792026404095","79357729360616193902807655643700292302","53073610528342643939637634752102331140","233298843227634921828128355666204684003","129041647635244075524337653918275144826","201497200635376658514585156517811832238","299108017017304219847357040897943149945","26336067661531312286298575742099149644","216431135408102165191893687207576056864","176281420003676838415340115292266963530","219325013445161890951510386503674400884","231031870505611136751596413830225061327","73397768373368757536479802789304542650","86297380719523360092289164958136849650","96504084766857505299204479415726309676","160057590753693384341480522250881637743","1133394177015753540700299389162097589","252693157415961571234960786732231294635","325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653","259482035435254778313450921017276894325"],"threshold":0.9},"id":"ASB-A-206807679-0f43b4af","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"function":"getDiscoverableTimeout","file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"function_hash":"337355188220726876884449145526534949697","length":273},"id":"ASB-A-206807679-57193b34","signature_type":"Function"},{"digest":{"function_hash":"224398954382340583561811694483425651957","length":350},"id":"ASB-A-206807679-da1724b4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","target":{"function":"setScanMode","file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558"],"severity":"High","spl":"2022-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-06-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["15034289598171731019070901338967543949","22452854176303668999173774811771995014","218805922682627626445775730674273039717","331177562355415707219285459176677723481"],"threshold":0.9},"id":"ASB-A-206807679-709ca6b9"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527"],"severity":"High","spl":"2022-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-06-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["91983733559064162424237768282443276951","319504346079806563258387665295186025399","253609973198217123155236395255894876158","199140676438839850654882467789767349138"],"threshold":0.9},"id":"ASB-A-206807679-e2b45f5d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d"],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-06-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-06-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-206807679-430bd72c","match_only_versions":["12"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653"],"threshold":0.9}},{"match_only_versions":["12"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"deprecated":false,"digest":{"length":297,"function_hash":"306408796174320226647143357411811607888"},"id":"ASB-A-206807679-e5dba575"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","target":{"function":"setDiscoverableTimeout","file":"src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"function_hash":"306408796174320226647143357411811607888","length":297},"id":"ASB-A-206807679-3d1f2430","match_only_versions":["12L"]},{"source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653"],"threshold":0.9},"id":"ASB-A-206807679-a51fd69c","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"],"severity":"High","spl":"2022-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}}],"schema_version":"1.9.0"}