{"id":"ASB-A-206987762","details":"In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-206987762","CVE-2022-20112"],"modified":"2026-05-28T15:16:54.500952700Z","published":"2022-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/c5d1f8d5b16153a046403e910eb4ff2224306cc9"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-05-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2022-05-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-206987762-0b2a442f","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java","function":"getAvailabilityStatus"},"digest":{"function_hash":"321733357164553032741408608226387281188","length":150},"signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","id":"ASB-A-206987762-6c353303","deprecated":false,"target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java"},"digest":{"threshold":0.9,"line_hashes":["250217041909215422489376352889381844384","30614813453035800348791517300229173792","21559428915232086082342630364423049688","312487171729731347703751447130010780116","297057082058474901114027675289630414523","333376375925661085281441576422414143269"]},"signature_type":"Line"}],"severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206987762.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-05-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-05-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-206987762-6a853928","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java"},"digest":{"threshold":0.9,"line_hashes":["250217041909215422489376352889381844384","30614813453035800348791517300229173792","21559428915232086082342630364423049688","312487171729731347703751447130010780116","297057082058474901114027675289630414523","333376375925661085281441576422414143269"]},"signature_type":"Line"},{"signature_version":"v1","id":"ASB-A-206987762-abac2893","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java","function":"getAvailabilityStatus"},"digest":{"function_hash":"321733357164553032741408608226387281188","length":150},"signature_type":"Function"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"],"types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206987762.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-05-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-05-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-206987762-b55a8f16","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java","function":"getAvailabilityStatus"},"digest":{"function_hash":"321733357164553032741408608226387281188","length":150},"signature_type":"Function"},{"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","id":"ASB-A-206987762-de8e9d68","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java"},"digest":{"threshold":0.9,"line_hashes":["250217041909215422489376352889381844384","30614813453035800348791517300229173792","21559428915232086082342630364423049688","312487171729731347703751447130010780116","297057082058474901114027675289630414523","333376375925661085281441576422414143269"]},"signature_type":"Line"}],"severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206987762.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-05-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2022-05-01","vanir_signatures":[{"signature_version":"v1","id":"ASB-A-206987762-842b33fb","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java","function":"getAvailabilityStatus"},"digest":{"function_hash":"321733357164553032741408608226387281188","length":150},"signature_type":"Function"},{"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327","id":"ASB-A-206987762-db5b38c1","target":{"file":"src/com/android/settings/network/PrivateDnsPreferenceController.java"},"digest":{"threshold":0.9,"line_hashes":["250217041909215422489376352889381844384","30614813453035800348791517300229173792","21559428915232086082342630364423049688","312487171729731347703751447130010780116","297057082058474901114027675289630414523","333376375925661085281441576422414143269"]},"signature_type":"Line"}],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52e863b5a212889d4f8cb89a4028c42af59c9327"],"types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-206987762.json"}}],"schema_version":"1.7.5"}