{"id":"ASB-A-243849844","details":"In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-243849844","CVE-2022-20495"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-12-01"}]}],"versions":["10"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"severity":"High","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-243849844-4b21c9fc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"getEnabledAccessibilityServiceList"},"deprecated":false,"digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}},{"target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9},"id":"ASB-A-243849844-b8e27c37","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-12-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"severity":"High","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"getEnabledAccessibilityServiceList"},"deprecated":false,"digest":{"function_hash":"256567717900539817207598731645102704557","length":569},"id":"ASB-A-243849844-b144b9f5","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9},"id":"ASB-A-243849844-c66a22b9","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"severity":"High","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"},"id":"ASB-A-243849844-4c0eb4cf","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9},"id":"ASB-A-243849844-4f9581db","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"]},"id":"ASB-A-243849844-170122da","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"getEnabledAccessibilityServiceList"},"deprecated":false,"digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"},"id":"ASB-A-243849844-5a23e3b9","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"severity":"High","spl":"2022-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9},"id":"ASB-A-243849844-123210b2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java","function":"getEnabledAccessibilityServiceList"},"deprecated":false,"digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"},"id":"ASB-A-243849844-2185f50a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}}],"schema_version":"1.9.0"}