{"id":"ASB-A-231496105","details":"In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-231496105","CVE-2022-20240"],"modified":"2026-04-24T15:37:38.793646Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/61c2d0291bd5b9b39a1d7db7454b3d7c630e7de9"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/cad40dc9b13596b85df5a41b25fc07c0854dc65a"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/530407c903c3b06c6bd0a423937531f95eb116ae"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Wifi/+/bb99dc7a9e5c6b14f672ee12c6e4093803b8b915"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"severity":"High","vanir_signatures":[{"id":"ASB-A-231496105-18883cf2","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["168149929116503664461813113991766821421","139436274516220223698822537870033012269","246355147872454468010446409861288447715","165462986073571324282044550197153947044","260275766334139120717668833150014759553","191715191793205716465398872182497785380","302429306498499206515073086888635841509","28034202699633924377934181069895711517","304157201227273680580054751271425893556"]},"deprecated":false},{"id":"ASB-A-231496105-3c78d917","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"file":"core/java/android/app/AppOpsManager.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["333004141841961389172620261135932749679","89857665520800945892087856214709785240","174016828635114852806756382166578884954","213848584682783567061178554717581727214","213848584682783567061178554717581727214","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","178685420952493366161151037228173587357","323862811657808820199895429461449033295","172851754198710831360208205726140696844","74319369933616512803145640709357483775","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","94297448559448385734258709756561109635","183571857917098355995430059067945437895","231355718516759045925096208710506966753","190910644323319203016238796257233780346","50456745090508302344516703751629959346","170003216249822339875418858001180536222","292885038649111259090236445317783673249","267789059819050148366529019044926381509","299670398654766460699254033246307703285","130657974524070960929315722170793224076","290131175657484087281470637668357524752"]},"deprecated":false},{"id":"ASB-A-231496105-6b8d6473","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"function":"getBypassforPackage","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Function","digest":{"length":254,"function_hash":"88897209084590087665922884696267447625"},"deprecated":false},{"id":"ASB-A-231496105-c032a70c","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"function":"isOpRestrictedLocked","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Function","digest":{"length":870,"function_hash":"43231089065105065375524541040624287164"},"deprecated":false},{"id":"ASB-A-231496105-d5648fab","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0","target":{"file":"core/java/android/app/AppOpsManager.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["111400768076500226407069141782556351593","216560180838675918637853852682089799365","245917168920956267784996242616646963509","217963627627744030253978043159836926092","5713013725955715142044643145842555623"]},"deprecated":false}],"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/25f1b6a1ac5c71ebafe4b9235829aa3a79d1dd21","https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231496105.json"}},{"package":{"name":"platform/packages/modules/Wifi","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"severity":"High","vanir_signatures":[{"id":"ASB-A-231496105-2c256e50","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"enforceCanAccessScanResultsForWifiScanner","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":617,"function_hash":"289139114456010572259566462303694312588"},"deprecated":false},{"id":"ASB-A-231496105-61a65270","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"checkCallersFineLocationPermission","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":432,"function_hash":"15397169924466002301048257008193050167"},"deprecated":false},{"id":"ASB-A-231496105-705766da","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["19831358299399943583179334296197055302","183777785248348122401683106955805939399","34075110875282535618572364503116820625","247803289308958939041313306699509699419","154623075196566111406704057886519803576","62690225152807030669126704139162043551","68306262298392969082445863401888039282","72475156664686923119041247043727751716","53993378455130952313152206341020572204","81540051439898314215456154076814595112","211507552307243013600710597175584004355","157840185077450552434100864470314368598","169694829992740909101504239054484510359","134200273278587846242394943687284927829","178676600666870987897513653437137811294","115987511841326095703745783191813255302","312573181804635896214101030778605107635","293915166135138036783114045682045344058","173004159169691864231757072185567661756","258442460609758662950587633301727304722","329721609069990995037800649952180937626","262173981762223836348503790980049514413","199702937687716993582515676020963864702","79467151087155781976771431713371866330","141790706957766889774652427778336981928"]},"deprecated":false},{"id":"ASB-A-231496105-f3eb1cfb","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"enforceFineLocationPermission","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":213,"function_hash":"318220793797999637493299458924580349849"},"deprecated":false}],"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231496105.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"severity":"High","vanir_signatures":[{"id":"ASB-A-231496105-2affead7","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["168149929116503664461813113991766821421","139436274516220223698822537870033012269","246355147872454468010446409861288447715","165462986073571324282044550197153947044","260275766334139120717668833150014759553","191715191793205716465398872182497785380","302429306498499206515073086888635841509","28034202699633924377934181069895711517","304157201227273680580054751271425893556"]},"deprecated":false},{"id":"ASB-A-231496105-5cc63c46","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"function":"getBypassforPackage","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Function","digest":{"length":254,"function_hash":"88897209084590087665922884696267447625"},"deprecated":false},{"id":"ASB-A-231496105-5eb3db38","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"function":"isOpRestrictedLocked","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"signature_type":"Function","digest":{"length":870,"function_hash":"43231089065105065375524541040624287164"},"deprecated":false},{"id":"ASB-A-231496105-be145f62","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","target":{"file":"core/java/android/app/AppOpsManager.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["333004141841961389172620261135932749679","89857665520800945892087856214709785240","174016828635114852806756382166578884954","213848584682783567061178554717581727214","213848584682783567061178554717581727214","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","178685420952493366161151037228173587357","323862811657808820199895429461449033295","172851754198710831360208205726140696844","74319369933616512803145640709357483775","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","58512286477795118794937599630399416946","250097779096880568101066423653481917828","40187803491564778987740340096908997809","5713013725955715142044643145842555623","94297448559448385734258709756561109635","183571857917098355995430059067945437895","231355718516759045925096208710506966753","190910644323319203016238796257233780346","50456745090508302344516703751629959346","170003216249822339875418858001180536222","292885038649111259090236445317783673249","267789059819050148366529019044926381509","299670398654766460699254033246307703285","130657974524070960929315722170793224076","290131175657484087281470637668357524752"]},"deprecated":false},{"id":"ASB-A-231496105-feea00e4","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0","target":{"file":"core/java/android/app/AppOpsManager.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["111400768076500226407069141782556351593","216560180838675918637853852682089799365","245917168920956267784996242616646963509","217963627627744030253978043159836926092","5713013725955715142044643145842555623"]},"deprecated":false}],"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/25f1b6a1ac5c71ebafe4b9235829aa3a79d1dd21","https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba","https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231496105.json"}},{"package":{"name":"platform/packages/modules/Wifi","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"severity":"High","vanir_signatures":[{"id":"ASB-A-231496105-2a368379","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"enforceCanAccessScanResultsForWifiScanner","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":617,"function_hash":"289139114456010572259566462303694312588"},"deprecated":false},{"id":"ASB-A-231496105-772ac495","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["19831358299399943583179334296197055302","183777785248348122401683106955805939399","34075110875282535618572364503116820625","247803289308958939041313306699509699419","154623075196566111406704057886519803576","62690225152807030669126704139162043551","68306262298392969082445863401888039282","72475156664686923119041247043727751716","53993378455130952313152206341020572204","81540051439898314215456154076814595112","211507552307243013600710597175584004355","157840185077450552434100864470314368598","169694829992740909101504239054484510359","134200273278587846242394943687284927829","178676600666870987897513653437137811294","115987511841326095703745783191813255302","312573181804635896214101030778605107635","293915166135138036783114045682045344058","173004159169691864231757072185567661756","258442460609758662950587633301727304722","329721609069990995037800649952180937626","262173981762223836348503790980049514413","199702937687716993582515676020963864702","79467151087155781976771431713371866330","141790706957766889774652427778336981928"]},"deprecated":false},{"id":"ASB-A-231496105-c91dd05a","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"enforceFineLocationPermission","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":213,"function_hash":"318220793797999637493299458924580349849"},"deprecated":false},{"id":"ASB-A-231496105-d65ae10d","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4","target":{"function":"checkCallersFineLocationPermission","file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"},"signature_type":"Function","digest":{"length":432,"function_hash":"15397169924466002301048257008193050167"},"deprecated":false}],"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-231496105.json"}}],"schema_version":"1.7.5"}