{"id":"ASB-A-231322873","details":"In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-231322873","CVE-2022-20415"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9194bce0d58093bbb0aa77c6050bb9a15d9dbc2a"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-10-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-10-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"268709947457808782884596182483301889944","length":1337},"id":"ASB-A-231322873-83350a3d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","target":{"function":"shouldHeadsUp","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java"},"deprecated":false},{"digest":{"function_hash":"302805064868753769474438572865928628369","length":1068},"id":"ASB-A-231322873-85a060af","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","target":{"function":"handleFullScreenIntent","file":"packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java"},"deprecated":false},{"digest":{"line_hashes":["21940031268955891227493674901624752295","235586351066527852661551508291587105388","241689917641917854826184097706341259288","224251774399045252105721997222205892340","199121957812317939254904450573611658596"],"threshold":0.9},"id":"ASB-A-231322873-d01aba2a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/phone/StatusBarNotificationActivityStarter.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationInterruptionStateProvider.java"},"deprecated":false,"digest":{"line_hashes":["1747795920082813673810050641646648625","245373561216564314408407729898523497141","79303652884614057329397731234630098621","45756085378735733059965536294186124766","26721156531583433665178872941127841904","259517971268462732898062030377347592705","96566401647609796946539463968098915370","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","223967102018963825188038630474094567296","236686065813650549054735002670714375539"],"threshold":0.9},"id":"ASB-A-231322873-dfb78ee0","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8ce3c53fcf641e4bcec73376542767bbc04e79a1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-10-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"deprecated":false,"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"],"threshold":0.9},"id":"ASB-A-231322873-9cc7c81b","signature_type":"Line"},{"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"id":"ASB-A-231322873-c6fa1995","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"deprecated":false,"digest":{"function_hash":"285468308528632235203795036305709164543","length":1775},"id":"ASB-A-231322873-e9d3848c","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-10-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-10-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":207,"function_hash":"240837714206259610946521637483419433199"},"id":"ASB-A-231322873-36e1fd7e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"]},"id":"ASB-A-231322873-7b212fa6"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"function":"shouldHeadsUpWhenAwake","file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"deprecated":false,"digest":{"function_hash":"285468308528632235203795036305709164543","length":1775},"id":"ASB-A-231322873-d9c6d03d","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-10-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","101232710443763646319066923481578182089","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","155562803589524482155381748983214650660","33158359675856764532101126667861144325"],"threshold":0.9},"id":"ASB-A-231322873-1d6b3324","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"240837714206259610946521637483419433199","length":207},"id":"ASB-A-231322873-418ef490","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"}},{"digest":{"length":1775,"function_hash":"285468308528632235203795036305709164543"},"id":"ASB-A-231322873-97ab88b3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/09761a98b5bbbefa331c49a96b50b4e08dc3f8df"],"severity":"Moderate","spl":"2022-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-10-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-10-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15002384506786101120514745214771865555","248444117079812531491354465915514282623","281204685032213872646242640783182908345","329123499263948383715934258951774098410","249897533707904935156699186749365988203","44950183582803653591395062160694249906","40939851882067743232961579552057137269","893820694871671961193647853042026145","102218621015709428499015363826812275521","335592471619252541168490349011359568829","15983894647188451408510615384266884668","241493822973618713146030928487831495652","70349766751275827442435830157860638553","274000608261375659659963782313269591027","60090026026213295029440159738967821272","195848382315310501926053252634053978473"]},"id":"ASB-A-231322873-0941f59e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldHeadsUpWhenAwake"},"deprecated":false,"digest":{"length":1198,"function_hash":"79101331109160012015592815747739171993"},"id":"ASB-A-231322873-cc8b30e4","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32","target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/interruption/NotificationInterruptStateProviderImpl.java","function":"shouldLaunchFullScreenIntentWhenAdded"},"deprecated":false,"digest":{"length":207,"function_hash":"240837714206259610946521637483419433199"},"id":"ASB-A-231322873-d5552b31","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d107a27fe5c45065547a0257d3f995e23ba01e32"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231322873.json"}}],"schema_version":"1.9.0"}