{"id":"ASB-A-206807679","details":"In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-206807679","CVE-2022-20133"],"modified":"2026-04-22T14:59:17.843400Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558"],"vanir_signatures":[{"id":"ASB-A-206807679-0564ff75","deprecated":false,"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","signature_version":"v1","digest":{"function_hash":"306408796174320226647143357411811607888","length":297}},{"id":"ASB-A-206807679-0f43b4af","deprecated":false,"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","signature_version":"v1","digest":{"line_hashes":["184196211465596637036676436981022160986","310663038790803474228144224051457634065","235200042516890789000893520623616856433","74056111292228662419642069507111208323","280865106268737356318352464790165724163","31751067178526632610812621753358219135","121380037984780544106085503251813162023","115406219874387320131559651200307225012","202006277810136237772203677493381325889","184997035097119368774453889288419654155","228403452926252819945841653792026404095","79357729360616193902807655643700292302","53073610528342643939637634752102331140","233298843227634921828128355666204684003","129041647635244075524337653918275144826","201497200635376658514585156517811832238","299108017017304219847357040897943149945","26336067661531312286298575742099149644","216431135408102165191893687207576056864","176281420003676838415340115292266963530","219325013445161890951510386503674400884","231031870505611136751596413830225061327","73397768373368757536479802789304542650","86297380719523360092289164958136849650","96504084766857505299204479415726309676","160057590753693384341480522250881637743","1133394177015753540700299389162097589","252693157415961571234960786732231294635","325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653","259482035435254778313450921017276894325"],"threshold":0.9}},{"id":"ASB-A-206807679-57193b34","deprecated":false,"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"getDiscoverableTimeout"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","signature_version":"v1","digest":{"function_hash":"337355188220726876884449145526534949697","length":273}},{"id":"ASB-A-206807679-da1724b4","deprecated":false,"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"setScanMode"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558","signature_version":"v1","digest":{"function_hash":"224398954382340583561811694483425651957","length":350}}],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-06-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527"],"vanir_signatures":[{"id":"ASB-A-206807679-709ca6b9","deprecated":false,"target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/528ea846133dc7dc4ce843e5b649abd50b58d527","signature_version":"v1","digest":{"line_hashes":["15034289598171731019070901338967543949","22452854176303668999173774811771995014","218805922682627626445775730674273039717","331177562355415707219285459176677723481"],"threshold":0.9}}],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-06-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d"],"vanir_signatures":[{"id":"ASB-A-206807679-e2b45f5d","deprecated":false,"target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/f9ac0a092549dd1a8575fbfeec71fafb69c3f63d","signature_version":"v1","digest":{"line_hashes":["91983733559064162424237768282443276951","319504346079806563258387665295186025399","253609973198217123155236395255894876158","199140676438839850654882467789767349138"],"threshold":0.9}}],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-06-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"],"vanir_signatures":[{"id":"ASB-A-206807679-430bd72c","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"signature_version":"v1","deprecated":false,"match_only_versions":["12"],"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","digest":{"line_hashes":["325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653"],"threshold":0.9}},{"id":"ASB-A-206807679-e5dba575","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"signature_version":"v1","deprecated":false,"match_only_versions":["12"],"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","digest":{"function_hash":"306408796174320226647143357411811607888","length":297}}],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}},{"package":{"name":"platform/packages/apps/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf"],"vanir_signatures":[{"id":"ASB-A-206807679-3d1f2430","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java","function":"setDiscoverableTimeout"},"signature_version":"v1","deprecated":false,"match_only_versions":["12L"],"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","digest":{"function_hash":"306408796174320226647143357411811607888","length":297}},{"id":"ASB-A-206807679-a51fd69c","target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"},"signature_version":"v1","deprecated":false,"match_only_versions":["12L"],"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/cc22abc0643c66e5873cbd0d15cd128816a186cf","digest":{"line_hashes":["325256900392167122739568556677971918605","59383564349327758604786432256412400049","97788076907198308619448996106236548653"],"threshold":0.9}}],"severity":"High","spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206807679.json"}}],"schema_version":"1.7.5"}