{"id":"ASB-A-243849844","details":"In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-243849844","CVE-2022-20495"],"modified":"2026-04-30T15:48:46.890647Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-12-01"}]}],"versions":["10"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"spl":"2022-12-01","vanir_signatures":[{"signature_type":"Function","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-4b21c9fc","signature_version":"v1","digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}},{"signature_type":"Line","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-b8e27c37","signature_version":"v1","digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-12-01"}]}],"versions":["11"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"spl":"2022-12-01","vanir_signatures":[{"signature_type":"Function","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-b144b9f5","signature_version":"v1","digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}},{"signature_type":"Line","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-c66a22b9","signature_version":"v1","digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-12-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"spl":"2022-12-01","vanir_signatures":[{"signature_type":"Function","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-4c0eb4cf","signature_version":"v1","digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}},{"signature_type":"Line","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-4f9581db","signature_version":"v1","digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-12-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"spl":"2022-12-01","vanir_signatures":[{"signature_type":"Line","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-170122da","signature_version":"v1","digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9}},{"signature_type":"Function","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-5a23e3b9","signature_version":"v1","digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377"],"spl":"2022-12-01","vanir_signatures":[{"signature_type":"Line","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-123210b2","signature_version":"v1","digest":{"line_hashes":["15472168467829777155972695369766909984","113313693706057117147096543104199435558","105833602642437050762795875353718347326","110806656359569617845981554468547802851"],"threshold":0.9}},{"signature_type":"Function","target":{"function":"getEnabledAccessibilityServiceList","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/2bc4d49c2b0265f5de1c62d1342b1426cc5e1377","id":"ASB-A-243849844-2185f50a","signature_version":"v1","digest":{"length":569,"function_hash":"256567717900539817207598731645102704557"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243849844.json"}}],"schema_version":"1.7.5"}