{"id":"ASB-A-221859734","details":"In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-221859734","CVE-2022-20398"],"modified":"2026-05-19T16:54:37.272608834Z","published":"2022-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f"}],"affected":[{"package":{"name":"platform/packages/modules/Wifi","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13-next:0"},{"fixed":"13-next:2022-09-01"}]}],"versions":["13-next"],"ecosystem_specific":{"types":["EoP"],"spl":"2022-09-01","severity":"Moderate","vanir_signatures":[{"id":"ASB-A-221859734-0f842235","deprecated":false,"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"function":"addOrUpdateNetwork","file":"service/java/com/android/server/wifi/WifiServiceImpl.java"},"digest":{"length":1938,"function_hash":"293594231454106066202648911088914014586"}},{"id":"ASB-A-221859734-2d674781","deprecated":false,"signature_version":"v1","signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/WifiServiceImpl.java"},"digest":{"line_hashes":["106075586204482335038976748081962302294","50254125161359841256617685321503778893","134973327598480085166434995507770650837","28813555467455531340252744248365923111","225435854086273964432355916192461277807","82043909163773608070549931900080330595","129469515357280746322246128026138082303","289452559497219223745714617889368962341","37334760508184369337165119594598746289","129355241784036593595292419231383845311","225255828251713566110152665276759195922","74477090221252033040801604394725016148","245245506821984838658377438735566823394","133659126509778478122343584755180096842","148885302954478283238374509563882639897","257186594853830201459088892786358004881","278417732000440066771118080832195917380","214299252086930989744352307881169018017","70759636909357249512516047906321604701","242034345642079937495221304327996039587","232221736637048000480626678019606874799","231331281647827883607709863219391449970"],"threshold":0.9}},{"id":"ASB-A-221859734-96bc66c0","deprecated":false,"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java","function":"getCurrentUser"},"digest":{"length":70,"function_hash":"86098240229774875250991448927674820235"}},{"id":"ASB-A-221859734-9bbf9900","deprecated":false,"signature_version":"v1","signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"digest":{"line_hashes":["215906072357966659079777844652605955098","123427533635257855312621267060376553090","284278039488370649357553090113176000535","117240947406735192951363986640445889294","12720297399195096143680386400694880430","210018469119573588783296958352348880318"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221859734.json"}},{"package":{"name":"platform/packages/modules/Wifi","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"spl":"2022-09-01","severity":"Moderate","vanir_signatures":[{"id":"ASB-A-221859734-12f02800","deprecated":false,"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"function":"addOrUpdateNetwork","file":"service/java/com/android/server/wifi/WifiServiceImpl.java"},"digest":{"length":1938,"function_hash":"293594231454106066202648911088914014586"}},{"id":"ASB-A-221859734-b6834f6b","deprecated":false,"signature_version":"v1","signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java","function":"getCurrentUser"},"digest":{"length":70,"function_hash":"86098240229774875250991448927674820235"}},{"id":"ASB-A-221859734-b993c463","deprecated":false,"signature_version":"v1","signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"digest":{"line_hashes":["215906072357966659079777844652605955098","123427533635257855312621267060376553090","284278039488370649357553090113176000535","117240947406735192951363986640445889294","12720297399195096143680386400694880430","210018469119573588783296958352348880318"],"threshold":0.9}},{"id":"ASB-A-221859734-bf864736","deprecated":false,"signature_version":"v1","signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f","target":{"file":"service/java/com/android/server/wifi/WifiServiceImpl.java"},"digest":{"line_hashes":["106075586204482335038976748081962302294","50254125161359841256617685321503778893","134973327598480085166434995507770650837","28813555467455531340252744248365923111","225435854086273964432355916192461277807","82043909163773608070549931900080330595","129469515357280746322246128026138082303","289452559497219223745714617889368962341","37334760508184369337165119594598746289","129355241784036593595292419231383845311","225255828251713566110152665276759195922","74477090221252033040801604394725016148","245245506821984838658377438735566823394","133659126509778478122343584755180096842","148885302954478283238374509563882639897","257186594853830201459088892786358004881","278417732000440066771118080832195917380","214299252086930989744352307881169018017","70759636909357249512516047906321604701","242034345642079937495221304327996039587","232221736637048000480626678019606874799","231331281647827883607709863219391449970"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/737e26535baeb007b9034f581b4616699b05725f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-221859734.json"}}],"schema_version":"1.7.5"}