{"id":"ASB-A-232541124","details":"In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-232541124","CVE-2022-20344"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-08-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/a49c413aee3f89aa68963f67fb144355608e12c6"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/899e8cd0749cb3f43bef0bdb28002edab42bbb1b"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-08-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"High","spl":"2022-08-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-232541124-9b3d0f0f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/0840cdd08f39994e3f8c58eb65f24a8db1dc1173","target":{"file":"services/surfaceflinger/Scheduler/EventThread.h"},"deprecated":false,"digest":{"line_hashes":["127469846548409983470268128607023459878","203863174457145462361197438585032144196","74364492603176318313944470921850953713","38035154383168608973232091071577427631"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/0840cdd08f39994e3f8c58eb65f24a8db1dc1173","target":{"function":"EventThreadConnection::stealReceiveChannel","file":"services/surfaceflinger/Scheduler/EventThread.cpp"},"deprecated":false,"digest":{"function_hash":"120725164979726759199208347309898018967","length":147},"id":"ASB-A-232541124-de95b6ee"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["221907669032479801584207109915539829466","138596314038625758329930666925880852430","205864945925658577086876635294506456286","111019090128844940958139250973217588210"]},"id":"ASB-A-232541124-e9128e7a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/0840cdd08f39994e3f8c58eb65f24a8db1dc1173","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/0840cdd08f39994e3f8c58eb65f24a8db1dc1173"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232541124.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-08-01"}]}],"versions":["11"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/a820057ae00dba322b10d47b3711b04519324690","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp"},"deprecated":false,"digest":{"line_hashes":["221907669032479801584207109915539829466","138596314038625758329930666925880852430","205864945925658577086876635294506456286","111019090128844940958139250973217588210"],"threshold":0.9},"id":"ASB-A-232541124-0b3e1ae8"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/a820057ae00dba322b10d47b3711b04519324690","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp","function":"EventThreadConnection::stealReceiveChannel"},"deprecated":false,"digest":{"length":147,"function_hash":"120725164979726759199208347309898018967"},"id":"ASB-A-232541124-5ccaab1b"},{"deprecated":false,"digest":{"line_hashes":["127469846548409983470268128607023459878","203863174457145462361197438585032144196","74364492603176318313944470921850953713","38035154383168608973232091071577427631"],"threshold":0.9},"id":"ASB-A-232541124-97a46e1e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/a820057ae00dba322b10d47b3711b04519324690","target":{"file":"services/surfaceflinger/Scheduler/EventThread.h"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/a820057ae00dba322b10d47b3711b04519324690"],"severity":"High","spl":"2022-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232541124.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-08-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2022-08-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"103285955403123022205109012819107315947","length":232},"id":"ASB-A-232541124-2600328f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/29e34cfcf95c6de1f2cbfe2bf588e4e354dbabe0","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp","function":"EventThreadConnection::stealReceiveChannel"}},{"digest":{"threshold":0.9,"line_hashes":["127469846548409983470268128607023459878","188398773197276973434461446177019563054","19997007814924338987186876491082489832","204955967200086192988718999219434011228"]},"id":"ASB-A-232541124-55167f91","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/29e34cfcf95c6de1f2cbfe2bf588e4e354dbabe0","target":{"file":"services/surfaceflinger/Scheduler/EventThread.h"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/native/+/29e34cfcf95c6de1f2cbfe2bf588e4e354dbabe0","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp"},"deprecated":false,"digest":{"line_hashes":["221907669032479801584207109915539829466","138596314038625758329930666925880852430","186654799477268374922345054802916573947","196432090748956429713506356090416189275"],"threshold":0.9},"id":"ASB-A-232541124-79abf23a","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/29e34cfcf95c6de1f2cbfe2bf588e4e354dbabe0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232541124.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-08-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2022-08-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["127469846548409983470268128607023459878","188398773197276973434461446177019563054","19997007814924338987186876491082489832","204955967200086192988718999219434011228"],"threshold":0.9},"id":"ASB-A-232541124-038a302b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/97a317064a76b8fc3a65bd980027f820fd4d53ae","target":{"file":"services/surfaceflinger/Scheduler/EventThread.h"}},{"digest":{"function_hash":"103285955403123022205109012819107315947","length":232},"id":"ASB-A-232541124-cf660c59","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/97a317064a76b8fc3a65bd980027f820fd4d53ae","target":{"function":"EventThreadConnection::stealReceiveChannel","file":"services/surfaceflinger/Scheduler/EventThread.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/97a317064a76b8fc3a65bd980027f820fd4d53ae","target":{"file":"services/surfaceflinger/Scheduler/EventThread.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["221907669032479801584207109915539829466","138596314038625758329930666925880852430","186654799477268374922345054802916573947","196432090748956429713506356090416189275"]},"id":"ASB-A-232541124-e47ce203"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/97a317064a76b8fc3a65bd980027f820fd4d53ae"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-232541124.json"}}],"schema_version":"1.9.0"}