{"id":"ASB-A-231322873","details":"In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-231322873","CVE-2022-20415"],"modified":"2026-04-30T15:48:46.890647Z","published":"2022-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9194bce0d58093bbb0aa77c6050bb9a15d9dbc2a"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-10-01"}]}],"versions":["10"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java","function":"shouldHeadsUp"},"digest":{"function_hash":"268709947457808782884596182483301889944","length":1337},"source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","id":"ASB-A-231322873-83350a3d","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java","function":"handleFullScreenIntent"},"digest":{"function_hash":"302805064868753769474438572865928628369","length":1068},"source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","id":"ASB-A-231322873-85a060af","deprecated":false,"signature_version":"v1"},{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java"},"digest":{"line_hashes":["21940031268955891227493674901624752295","235586351066527852661551508291587105388","241689917641917854826184097706341259288","224251774399045252105721997222205892340","199121957812317939254904450573611658596"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","id":"ASB-A-231322873-d01aba2a","deprecated":false,"signature_version":"v1"},{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java"},"digest":{"line_hashes":["1747795920082813673810050641646648625","245373561216564314408407729898523497141","79303652884614057329397731234630098621","45756085378735733059965536294186124766","26721156531583433665178872941127841904","259517971268462732898062030377347592705","96566401647609796946539463968098915370","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","223967102018963825188038630474094567296","236686065813650549054735002670714375539"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","id":"ASB-A-231322873-dfb78ee0","deprecated":false,"signature_version":"v1"}],"severity":"Moderate","spl":"2022-10-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-10-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-9cc7c81b","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-c6fa1995","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"digest":{"function_hash":"285468308528632235203795036305709164543","length":1775},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-e9d3848c","deprecated":false,"signature_version":"v1"}],"severity":"Moderate","spl":"2022-10-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-10-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-36e1fd7e","deprecated":false,"signature_version":"v1"},{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-7b212fa6","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"digest":{"function_hash":"285468308528632235203795036305709164543","length":1775},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-d9c6d03d","deprecated":false,"signature_version":"v1"}],"severity":"Moderate","spl":"2022-10-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-10-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-1d6b3324","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-418ef490","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"digest":{"function_hash":"285468308528632235203795036305709164543","length":1775},"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","id":"ASB-A-231322873-97ab88b3","deprecated":false,"signature_version":"v1"}],"severity":"Moderate","spl":"2022-10-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-10-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","40939851882067743232961579552057137269","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","60090026026213295029440159738967821272","195848382315310501926053252634053978473"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32","id":"ASB-A-231322873-0941f59e","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"digest":{"function_hash":"79101331109160012015592815747739171993","length":1198},"source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32","id":"ASB-A-231322873-cc8b30e4","deprecated":false,"signature_version":"v1"},{"signature_type":"Function","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32","id":"ASB-A-231322873-d5552b31","deprecated":false,"signature_version":"v1"}],"severity":"Moderate","spl":"2022-10-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}}],"schema_version":"1.7.5"}