{"id":"ASB-A-219015884","details":"In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-219015884","CVE-2022-20220"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-07-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-07-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0aba93d7d0a92a277f540fec7d5b04b2850fa184"}],"affected":[{"package":{"name":"platform/packages/providers/ContactsProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-07-05"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8"],"severity":"High","spl":"2022-07-05","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8","target":{"file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"line_hashes":["80556162895880792831603875551434641542","261713554497495016265945414111035963751","223484236778549619715047498372853515431","212727300813294272073991136558766830669","145291450032720118371994974066181749592","83206619313910695128548435682764265229","84957994418400661474662027988111971266","160199517177949618493828767468458340714","306667458784816265871724482886101199225","165472891104289477114417372168957371229","148501115818883676817113523476465475572","279890213913258310656874654355957680438","258179191018602781453434504890871419424","261990686389993149118546137426451388807","157793474918727384552935276709041265292","303394727368492633530529340784274426657","18965481648146670354266081386648002232","251697982678667641201019146966373741689","39973034611118046241533072751258587783","264085753851315626503573994444377012027","98091311131399214891666419273000917671","216220454372179139125795804482220632779","47401923675628117697947464933786772299","84548400442674366318118914823687679270","287859958430371281590258505168553971026","159810972737882846981070977960741004821","102462974237692409826427485140294425528","2281476316063599756271812216418645963","302497987735875217573044640396691592319","123583553300097912274155540290893791864","109127505205732677383334803609398725149"],"threshold":0.9},"id":"ASB-A-219015884-0507dcee"},{"source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8","target":{"file":"src/com/android/providers/contacts/CallLogProvider.java","function":"syncCallComposerPics"},"deprecated":false,"digest":{"function_hash":"309386010514092342042245267834131134851","length":1646},"id":"ASB-A-219015884-3065edf8","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8","target":{"function":"deleteCallComposerPicture","file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"function_hash":"192327671234739927967485161192599275251","length":351},"id":"ASB-A-219015884-445b4252","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8","target":{"file":"src/com/android/providers/contacts/CallLogProvider.java","function":"allocateNewCallComposerPicture"},"deprecated":false,"digest":{"function_hash":"59884867351264151132995485155170850686","length":774},"id":"ASB-A-219015884-6a160514","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/74cf86e9b493220c5b3ecc0817eeb7e7188199c8","target":{"function":"openFile","file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"function_hash":"231545673366050250262952693884714281968","length":983},"id":"ASB-A-219015884-e0539cbd"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-219015884.json"}},{"package":{"name":"platform/packages/providers/ContactsProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-07-05"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2022-07-05","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af","target":{"file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"line_hashes":["80556162895880792831603875551434641542","261713554497495016265945414111035963751","223484236778549619715047498372853515431","212727300813294272073991136558766830669","145291450032720118371994974066181749592","83206619313910695128548435682764265229","84957994418400661474662027988111971266","160199517177949618493828767468458340714","306667458784816265871724482886101199225","165472891104289477114417372168957371229","148501115818883676817113523476465475572","279890213913258310656874654355957680438","258179191018602781453434504890871419424","261990686389993149118546137426451388807","157793474918727384552935276709041265292","303394727368492633530529340784274426657","18965481648146670354266081386648002232","251697982678667641201019146966373741689","39973034611118046241533072751258587783","264085753851315626503573994444377012027","98091311131399214891666419273000917671","216220454372179139125795804482220632779","47401923675628117697947464933786772299","84548400442674366318118914823687679270","287859958430371281590258505168553971026","159810972737882846981070977960741004821","102462974237692409826427485140294425528","2281476316063599756271812216418645963","302497987735875217573044640396691592319","123583553300097912274155540290893791864","109127505205732677383334803609398725149"],"threshold":0.9},"id":"ASB-A-219015884-08c99980","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af","target":{"function":"deleteCallComposerPicture","file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"length":351,"function_hash":"192327671234739927967485161192599275251"},"id":"ASB-A-219015884-2f846196","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af","target":{"function":"syncCallComposerPics","file":"src/com/android/providers/contacts/CallLogProvider.java"},"deprecated":false,"digest":{"length":1646,"function_hash":"309386010514092342042245267834131134851"},"id":"ASB-A-219015884-8d1df9d1","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"59884867351264151132995485155170850686","length":774},"id":"ASB-A-219015884-a1f8b29a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af","target":{"function":"allocateNewCallComposerPicture","file":"src/com/android/providers/contacts/CallLogProvider.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af","target":{"file":"src/com/android/providers/contacts/CallLogProvider.java","function":"openFile"},"deprecated":false,"digest":{"function_hash":"231545673366050250262952693884714281968","length":983},"id":"ASB-A-219015884-e47050ac","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/5fd7ebb59d6c2b64255a4aad484d5f2217d4f4af"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-219015884.json"}}],"schema_version":"1.9.0"}