{"id":"ASB-A-240663194","details":"In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting=\"true\" due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-240663194","CVE-2022-20475"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/f19d69f26fefb95d2f349cc66459691f434ac0a6"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-12-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/7da08c6bd31584744e91eb6b3914166344ecae33"],"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7da08c6bd31584744e91eb6b3914166344ecae33","digest":{"length":1839,"function_hash":"79367335984536868683060388927323698399"},"id":"ASB-A-240663194-31871ecc","deprecated":false,"signature_type":"Function","target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java","function":"processActivity"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7da08c6bd31584744e91eb6b3914166344ecae33","digest":{"line_hashes":["156696531665261001840361105050140513977","141577864991975549992388657836996666940","176173783978772524694805082768982610046","40656254098996569909265033914126337733","6035741319983973340794305195343138500","106076101888920704290679117356166803734","174141138331974519528807865623126836579","333588990833629625277664792135720220197"],"threshold":0.9},"id":"ASB-A-240663194-b69388b4","signature_type":"Line","deprecated":false,"target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-240663194.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb"],"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb","digest":{"length":1839,"function_hash":"79367335984536868683060388927323698399"},"id":"ASB-A-240663194-689311e5","signature_type":"Function","deprecated":false,"target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java","function":"processActivity"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb","digest":{"line_hashes":["156696531665261001840361105050140513977","141577864991975549992388657836996666940","176173783978772524694805082768982610046","40656254098996569909265033914126337733","6035741319983973340794305195343138500","106076101888920704290679117356166803734","174141138331974519528807865623126836579","333588990833629625277664792135720220197"],"threshold":0.9},"id":"ASB-A-240663194-6c5655b0","deprecated":false,"signature_type":"Line","target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-240663194.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb"],"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb","digest":{"line_hashes":["156696531665261001840361105050140513977","141577864991975549992388657836996666940","176173783978772524694805082768982610046","40656254098996569909265033914126337733","6035741319983973340794305195343138500","106076101888920704290679117356166803734","174141138331974519528807865623126836579","333588990833629625277664792135720220197"],"threshold":0.9},"id":"ASB-A-240663194-6ab63711","signature_type":"Line","deprecated":false,"target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7af50c4d5f0354438872167b0e446930caca9deb","digest":{"length":1839,"function_hash":"79367335984536868683060388927323698399"},"id":"ASB-A-240663194-ae0b3db2","deprecated":false,"signature_type":"Function","target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java","function":"processActivity"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-240663194.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/f63ee3bb84b6a6ebf34475f433471cf4c28fb3c7"],"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f63ee3bb84b6a6ebf34475f433471cf4c28fb3c7","digest":{"length":1833,"function_hash":"196881039074853251030040489618889753042"},"id":"ASB-A-240663194-115ef8b1","deprecated":false,"signature_type":"Function","target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java","function":"test"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f63ee3bb84b6a6ebf34475f433471cf4c28fb3c7","digest":{"line_hashes":["156696531665261001840361105050140513977","141577864991975549992388657836996666940","176173783978772524694805082768982610046","40656254098996569909265033914126337733","6035741319983973340794305195343138500","106076101888920704290679117356166803734","174141138331974519528807865623126836579","333588990833629625277664792135720220197"],"threshold":0.9},"id":"ASB-A-240663194-24f3ed21","signature_type":"Line","deprecated":false,"target":{"file":"services/core/java/com/android/server/wm/ResetTargetTaskHelper.java"}}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-240663194.json"}}],"schema_version":"1.7.5"}