{"id":"PUB-A-171495100","details":"In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-171495100","CVE-2022-20204"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"severity":"Moderate","spl":"2022-06-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"BugreportInfo"},"deprecated":false,"digest":{"length":896,"function_hash":"43394098026711568904688223253399089522"},"id":"PUB-A-171495100-02d4fa5a","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"},{"deprecated":false,"digest":{"function_hash":"143124606026022984317560122710176508176","length":1973},"id":"PUB-A-171495100-0c662371","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"requestBugReportWithDescription"}},{"match_only_versions":["12L-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["199467781227995332449719358867354624185","81145784797266711795509234977883025050","290071508793857913796587695625872982687","180391091017719417976959037300753501987","12978541085817512337948410269795550609","68077402472135631655203994559341361656","155852669922656336683897492081575580490","179036972304746424785430980152620654161","87494284027708935601148285712336820876","134209951690152479315853012808420384781","336715371056664688736466993795850730382","49262635493516352159733351503255909387","67791727794083830703140327573071636609","102846366802878842735572401577134737772","251622667379496030971194680750693739456","303973867199134061417256230698994420270","44973334737331154544507463793525956202","78342051384350935199873677419867239443","288173527268122915928947849763606560286","16944173145014927680870018655612686526","249672125853255965167085216940158374029","203133953822724327942276231820147846189","308007863869655357313442875023500743832","318194236413321272786878276802076167307","28421101371200743065071176557512863806","129541302179883735063433926107653315912","138581321621043443499885446667321352396","206754363963698008518586022397668817720","161613523233780073102635856434109072422","97634628465229911114848194570004300773","170706851678826021428561428074183902618","191251205031226745428063494784996303443","29610294267099467205519254964066367504","240027687100756705963423639462119084703","17767854768053344209685549345596033068","217641896663230319468669828090858705690","108008200617279989750381039956206869531","286204025811496821767194585033873139965","176666683423466015763011337360989310003","635156752936221863749497432094965443","324346983795653312194135438264030486067","93504989169904609719425383104335367405","279391506304257887500786549822834803159","281112959155691559256645321020937976454"]},"id":"PUB-A-171495100-213589f9"},{"digest":{"threshold":0.9,"line_hashes":["11974717292614229665125781150732126911","224626151571504496279568282677933767342","9033748220050446436383032833880146942"]},"id":"PUB-A-171495100-23d788fc","match_only_versions":["12L-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"core/java/android/app/admin/DevicePolicyManager.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"function":"requestBugreport","file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java"},"deprecated":false,"digest":{"length":887,"function_hash":"59189546060763283399139927039997248448"},"id":"PUB-A-171495100-381a7f3f","match_only_versions":["12L-next"],"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java","function":"onBugreportFinished"},"deprecated":false,"digest":{"length":728,"function_hash":"304619747940281548858900589500034375992"},"id":"PUB-A-171495100-723a2dc1","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1"},{"match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"function":"requestRemoteBugReport","file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"function_hash":"330742450136530391253839069133262440354","length":91},"id":"PUB-A-171495100-7f62be44"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333785043869998895598246558587411058005","99483968783869442725035170362996912675","116544507474930307210721706820507560154","149939898631446473464401674601044636453","231395100242204413377938674654908220357","4103252588248049375276403893125239504","72181448623870537767179570719583949038","137473533426836388275110939404713085229","37416203191937726643785462696998403343","128205157592908220455500669963110939763","246445266476099651357443284841001827369","145300328052590987059654688050992776360","253075435437442112356854748975122546240","151853178279769894980162476290537396862","211281637954740414970146433724985293741","35556733328047273966799777727626272884","18017850616947726909079256333152632170","154185861398598651456966464692339600194","9988619129823391200458753587179550201","128711847308751908646075009038571656872"]},"id":"PUB-A-171495100-872ceb14","match_only_versions":["12L-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java"}},{"target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"BugreportInfo"},"deprecated":false,"digest":{"function_hash":"337870246048598568174606142846103967345","length":443},"id":"PUB-A-171495100-90e7a250","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"function":"writeToParcel","file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"function_hash":"282318806279972422464837673501261912036","length":877},"id":"PUB-A-171495100-94acf696","match_only_versions":["12L-next"]},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"function":"sendRemoteBugreportFinishedBroadcast","file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"function_hash":"179783799270717389689997767768854914157","length":685},"id":"PUB-A-171495100-a28aef28","match_only_versions":["12L-next"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"sendBugreportFinishedBroadcastLocked"},"deprecated":false,"digest":{"length":525,"function_hash":"68716271567379599365454762161697468820"},"id":"PUB-A-171495100-a3451ee4","match_only_versions":["12L-next"],"signature_type":"Function"},{"id":"PUB-A-171495100-ed871be4","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"startBugreportAPI"},"deprecated":false,"digest":{"function_hash":"101745305161945802815612531538822999521","length":1762}},{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"requestBugReport"},"deprecated":false,"digest":{"function_hash":"334265612194035525934422498753300521342","length":103},"id":"PUB-A-171495100-f08286ae","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"},{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["41526336120789258751631375648463707103","1074755096598595873739467166931102845","175513794508249875206758989570143435511","282042604971335524280848016425741629172","98546925220534415701362301405720130024","15352909086097045530791399925344081588","324852663947952713305275727542123350715","307919466458131096867162215641302426162","176107429516770366567617423973421501110","138608444420076444183905780226611286739","329567354823053384322707578014228955363","229033139142433619136087419844097754091","7761918780391578288213429580710761603","297873503830133774202609679139883024199","112247284047854816040115288922956967595","265164371759118056113967205892745872864","76394916716579908478088989534202258380","311358628604606093534629859722367999449","302346794004477225882675061212700194363","113840666142760906506221613573461164037","64528573920877051427983890541962188494"],"threshold":0.9},"id":"PUB-A-171495100-f7b3bdc3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a4131c50d07c7b58c496bd82b9ab3389b6721654"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-171495100.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":1762,"function_hash":"101745305161945802815612531538822999521"},"id":"PUB-A-171495100-06b2607f","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"startBugreportAPI"}},{"id":"PUB-A-171495100-06bcf537","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["199467781227995332449719358867354624185","81145784797266711795509234977883025050","290071508793857913796587695625872982687","180391091017719417976959037300753501987","12978541085817512337948410269795550609","68077402472135631655203994559341361656","155852669922656336683897492081575580490","179036972304746424785430980152620654161","87494284027708935601148285712336820876","134209951690152479315853012808420384781","336715371056664688736466993795850730382","49262635493516352159733351503255909387","67791727794083830703140327573071636609","102846366802878842735572401577134737772","251622667379496030971194680750693739456","303973867199134061417256230698994420270","44973334737331154544507463793525956202","78342051384350935199873677419867239443","288173527268122915928947849763606560286","16944173145014927680870018655612686526","249672125853255965167085216940158374029","203133953822724327942276231820147846189","308007863869655357313442875023500743832","318194236413321272786878276802076167307","28421101371200743065071176557512863806","129541302179883735063433926107653315912","138581321621043443499885446667321352396","206754363963698008518586022397668817720","161613523233780073102635856434109072422","97634628465229911114848194570004300773","170706851678826021428561428074183902618","191251205031226745428063494784996303443","29610294267099467205519254964066367504","240027687100756705963423639462119084703","17767854768053344209685549345596033068","217641896663230319468669828090858705690","108008200617279989750381039956206869531","286204025811496821767194585033873139965","176666683423466015763011337360989310003","635156752936221863749497432094965443","324346983795653312194135438264030486067","93504989169904609719425383104335367405","279391506304257887500786549822834803159","281112959155691559256645321020937976454"]}},{"deprecated":false,"digest":{"line_hashes":["11974717292614229665125781150732126911","224626151571504496279568282677933767342","9033748220050446436383032833880146942"],"threshold":0.9},"id":"PUB-A-171495100-2946cc5b","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"core/java/android/app/admin/DevicePolicyManager.java"}},{"digest":{"function_hash":"59189546060763283399139927039997248448","length":887},"id":"PUB-A-171495100-45b9676f","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java","function":"requestBugreport"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"requestBugReport"},"deprecated":false,"digest":{"function_hash":"334265612194035525934422498753300521342","length":103},"id":"PUB-A-171495100-4a6d56ed","match_only_versions":["12L"]},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"writeToParcel"},"deprecated":false,"digest":{"length":877,"function_hash":"282318806279972422464837673501261912036"},"id":"PUB-A-171495100-4c0e4076","match_only_versions":["12L"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java","function":"onBugreportFinished"},"deprecated":false,"digest":{"function_hash":"304619747940281548858900589500034375992","length":728},"id":"PUB-A-171495100-5e716aed","match_only_versions":["12L"],"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"function":"sendRemoteBugreportFinishedBroadcast","file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"function_hash":"179783799270717389689997767768854914157","length":685},"id":"PUB-A-171495100-6091307c","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1"},{"match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"function":"BugreportInfo","file":"packages/Shell/src/com/android/shell/BugreportProgressService.java"},"deprecated":false,"digest":{"length":896,"function_hash":"43394098026711568904688223253399089522"},"id":"PUB-A-171495100-9ade4632"},{"match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"sendBugreportFinishedBroadcastLocked"},"deprecated":false,"digest":{"function_hash":"68716271567379599365454762161697468820","length":525},"id":"PUB-A-171495100-9d7a9f3d"},{"id":"PUB-A-171495100-a51c47a3","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"requestRemoteBugReport"},"deprecated":false,"digest":{"function_hash":"330742450136530391253839069133262440354","length":91}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["41526336120789258751631375648463707103","310017227991927466420915942264564051843","235192453272136470814257181228416686074","290679891064209465415335052333843146410","98546925220534415701362301405720130024","15352909086097045530791399925344081588","324852663947952713305275727542123350715","307919466458131096867162215641302426162","176107429516770366567617423973421501110","138608444420076444183905780226611286739","329567354823053384322707578014228955363","229033139142433619136087419844097754091","7761918780391578288213429580710761603","297873503830133774202609679139883024199","112247284047854816040115288922956967595","265164371759118056113967205892745872864","76394916716579908478088989534202258380","311358628604606093534629859722367999449","302346794004477225882675061212700194363","113840666142760906506221613573461164037","64528573920877051427983890541962188494"],"threshold":0.9},"id":"PUB-A-171495100-cd08a574","match_only_versions":["12L"]},{"digest":{"threshold":0.9,"line_hashes":["333785043869998895598246558587411058005","99483968783869442725035170362996912675","116544507474930307210721706820507560154","149939898631446473464401674601044636453","231395100242204413377938674654908220357","4103252588248049375276403893125239504","72181448623870537767179570719583949038","137473533426836388275110939404713085229","37416203191937726643785462696998403343","128205157592908220455500669963110939763","246445266476099651357443284841001827369","145300328052590987059654688050992776360","253075435437442112356854748975122546240","151853178279769894980162476290537396862","211281637954740414970146433724985293741","35556733328047273966799777727626272884","18017850616947726909079256333152632170","154185861398598651456966464692339600194","9988619129823391200458753587179550201","128711847308751908646075009038571656872"]},"id":"PUB-A-171495100-cf712398","match_only_versions":["12L"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/RemoteBugreportManager.java"},"deprecated":false},{"id":"PUB-A-171495100-f4192406","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"packages/Shell/src/com/android/shell/BugreportProgressService.java","function":"BugreportInfo"},"deprecated":false,"digest":{"function_hash":"337870246048598568174606142846103967345","length":443}},{"id":"PUB-A-171495100-f87ca4f6","match_only_versions":["12L"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"requestBugReportWithDescription"},"deprecated":false,"digest":{"function_hash":"143124606026022984317560122710176508176","length":1973}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f62904fd707b5b8999e44428f50690d0ee09cd5a"],"severity":"Moderate","spl":"2022-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-171495100.json"}}],"schema_version":"1.9.0"}