{"id":"ASB-A-216631962","details":"In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-216631962","CVE-2022-20142"],"modified":"2026-05-01T15:24:27.653932Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e20d8ae7104f3235c8a2d72c85d19644e2ac8d86"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5fc1c46f6312422364abbd178dd03ea6ff49960e"],"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":615,"function_hash":"329458592877134660334172681725740967584"},"signature_type":"Function","target":{"function":"createFromParcel","file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/5fc1c46f6312422364abbd178dd03ea6ff49960e","id":"ASB-A-216631962-09c42487","deprecated":false},{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["184615187229519317352301201980929637612","119911995133171752876899621748193227909","262784979149680618908871242953282125580","30790350962984040520758659315760465286","217320144805282038881288852457049770317","8011992843065816806732021836927597656","15154315980646925646273822706433439342","82618622351725863939608951834588492279","186304791646200806687889212758589658018","37316828977239924046318697844108685626","195352340105212105361665983000608108124","208566079734656761769501294918234425361"]},"signature_type":"Line","target":{"file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/5fc1c46f6312422364abbd178dd03ea6ff49960e","id":"ASB-A-216631962-dc86eaa3","deprecated":false}],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-216631962.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-06-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3e1ffdb29417f4fb994587a013fa56c83e157f6f"],"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":615,"function_hash":"329458592877134660334172681725740967584"},"signature_type":"Function","target":{"function":"createFromParcel","file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/3e1ffdb29417f4fb994587a013fa56c83e157f6f","id":"ASB-A-216631962-8c92240c","deprecated":false},{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["184615187229519317352301201980929637612","119911995133171752876899621748193227909","262784979149680618908871242953282125580","30790350962984040520758659315760465286","217320144805282038881288852457049770317","8011992843065816806732021836927597656","15154315980646925646273822706433439342","82618622351725863939608951834588492279","186304791646200806687889212758589658018","37316828977239924046318697844108685626","195352340105212105361665983000608108124","208566079734656761769501294918234425361"]},"signature_type":"Line","target":{"file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/3e1ffdb29417f4fb994587a013fa56c83e157f6f","id":"ASB-A-216631962-e63c9962","deprecated":false}],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-216631962.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-06-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ba3acb3e53c2f299a6326434ee19fe5e18ce8a30"],"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":615,"function_hash":"329458592877134660334172681725740967584"},"signature_type":"Function","target":{"function":"createFromParcel","file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/ba3acb3e53c2f299a6326434ee19fe5e18ce8a30","id":"ASB-A-216631962-205583bb","deprecated":false},{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["184615187229519317352301201980929637612","119911995133171752876899621748193227909","262784979149680618908871242953282125580","30790350962984040520758659315760465286","217320144805282038881288852457049770317","8011992843065816806732021836927597656","15154315980646925646273822706433439342","82618622351725863939608951834588492279","186304791646200806687889212758589658018","37316828977239924046318697844108685626","195352340105212105361665983000608108124","208566079734656761769501294918234425361"]},"signature_type":"Line","target":{"file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/ba3acb3e53c2f299a6326434ee19fe5e18ce8a30","id":"ASB-A-216631962-932ec662","deprecated":false}],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-216631962.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-06-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/094b1b927eb5cafefeaa214da38802bd22f01479"],"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["184615187229519317352301201980929637612","119911995133171752876899621748193227909","262784979149680618908871242953282125580","30790350962984040520758659315760465286","217320144805282038881288852457049770317","8011992843065816806732021836927597656","15154315980646925646273822706433439342","82618622351725863939608951834588492279","186304791646200806687889212758589658018","37316828977239924046318697844108685626","195352340105212105361665983000608108124","208566079734656761769501294918234425361"]},"signature_type":"Line","target":{"file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/094b1b927eb5cafefeaa214da38802bd22f01479","id":"ASB-A-216631962-4d1a3623","deprecated":false},{"signature_version":"v1","digest":{"length":615,"function_hash":"329458592877134660334172681725740967584"},"signature_type":"Function","target":{"function":"createFromParcel","file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/094b1b927eb5cafefeaa214da38802bd22f01479","id":"ASB-A-216631962-f5dc2042","deprecated":false}],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-216631962.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e20d8ae7104f3235c8a2d72c85d19644e2ac8d86"],"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["184615187229519317352301201980929637612","119911995133171752876899621748193227909","262784979149680618908871242953282125580","30790350962984040520758659315760465286","217320144805282038881288852457049770317","8011992843065816806732021836927597656","15154315980646925646273822706433439342","82618622351725863939608951834588492279","186304791646200806687889212758589658018","37316828977239924046318697844108685626","195352340105212105361665983000608108124","208566079734656761769501294918234425361"]},"signature_type":"Line","target":{"file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e20d8ae7104f3235c8a2d72c85d19644e2ac8d86","id":"ASB-A-216631962-2e25f65a","deprecated":false},{"signature_version":"v1","digest":{"length":615,"function_hash":"329458592877134660334172681725740967584"},"signature_type":"Function","target":{"function":"createFromParcel","file":"core/java/android/hardware/location/GeofenceHardwareRequestParcelable.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e20d8ae7104f3235c8a2d72c85d19644e2ac8d86","id":"ASB-A-216631962-a0b82470","deprecated":false}],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-216631962.json"}}],"schema_version":"1.7.5"}