{"id":"PUB-A-215912712","details":"In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-215912712","CVE-2022-20192"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"],"severity":"Moderate","spl":"2022-06-01","types":["EoP"],"vanir_signatures":[{"id":"PUB-A-215912712-0536a57b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"add","file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java"},"deprecated":false,"digest":{"length":309,"function_hash":"266004004414100078218679146360425037684"}},{"digest":{"line_hashes":["307975587768630657536385743269940051042","129571895563961595208330825225029915569","120489534548518309952564322799305312665","27445558377941926899303527121623302029","83009492359691535269599834475066089122","242363125001361202027442195738523802670","193430401147455584132599762128029672180","252307567104734172389202811549445370403"],"threshold":0.9},"id":"PUB-A-215912712-0e1b4cc1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"services/core/java/com/android/server/wm/Session.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"core/java/android/view/WindowlessWindowManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17686737021801134923380760931005880650","132210580519469319004308320375968209526","135902169074890242786529065395667085453","30187238928623378357292221212913018032","158500292227387259793422493870531899135","157473994530248800087446969901926750414","3554624916982651199122831179499286397","5373408571869161308241790047671666283","66953031833224888004651101549771875584","308002791425092254437893004673275369641","143086098992670610811390418642917599747","226688251488303744678384744181807250507","28744171646912162897373354997722176788","183248130313831857096967850360844829331","264679056851131321556390357525872630029","244506510009072707629547047307058480209","5484813515024828678280736639974151607","98168165945816108946915812514391913682","32864287871794712483081317261691410616","307975587768630657536385743269940051042","76122052778904437714693575498100955843","48033696707075702793373996737808958665"]},"id":"PUB-A-215912712-1e8cdb70","signature_type":"Line"},{"target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"handleTap"},"deprecated":false,"digest":{"length":143,"function_hash":"194024574188936834744100268737628594644"},"id":"PUB-A-215912712-1f45ca8b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"core/java/android/view/SurfaceControlViewHost.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["313447456436393578450352165333497830124","159955500546290620471829244372167147273","245617924789097587065637373491985033359","70144521634387495929408387018114747884"]},"id":"PUB-A-215912712-2b4f4ad8","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"grantEmbeddedWindowFocus"},"deprecated":false,"digest":{"function_hash":"307620882436853427180252805866804008327","length":1355},"id":"PUB-A-215912712-58c20eb8","signature_type":"Function"},{"id":"PUB-A-215912712-7ae2692c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"grantEmbeddedWindowFocus","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"function_hash":"41536229982092627211510767755923860933","length":1261}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"core/java/android/view/WindowlessWindowManager.java","function":"addToDisplay"},"deprecated":false,"digest":{"function_hash":"173568828509927570143806274639106458779","length":1363},"id":"PUB-A-215912712-808dcf5d"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"remove","file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java"},"deprecated":false,"digest":{"length":248,"function_hash":"267065823521529045684033885819322014145"},"id":"PUB-A-215912712-9033d584","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"286077618216485116393928546099126525768","length":122},"id":"PUB-A-215912712-941198ea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"setIsOverlay","file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java"}},{"target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java"},"deprecated":false,"digest":{"line_hashes":["111122913986043214337648687681084523164","299774918102398556928784908050133470352","6118059391038327457806559238760912538","278458067052608528666234082641956102942","323613906290305568114569722105271513615","277319330415602910703870405813293221247","280131073050254959127190007161039388685","17872331650406894598956152418694951647","205576568369135978193934845198033430771","231713717433687464958838342660489226126","170663188789405533190498353211788284081","77947182356533165268875933500400719804","224297892110077318995490831236837626923","324841501861252544257182440998596363300","155415797501036940465374299616886532333","209500334405559091860346116591151656957","205634861642230201165349138536725773497","307417433900226098033894432326852079901","47964460560293716390272378901255958953","106587980582975620963396486030542256532","243274474365661135643073550980233253258","122298865036439001389740065468810292055","122887771776450033160385624682157852669","319174063616503398322351737414644904754","101923151356666984389465939473999578357","221684015862223591517238411370451932655","252476985300961096795137545560356861557","229223661845914667207247256007332721838","144213558391825386109111068533916020348","74727407718073676886435133196161375478","81007536294896407291950264245404796161","256450374089892551799521076228142348190","187961048826224832109048999708068771074","199944379225751195658832412295287763010","229075557150457164382327372980894757376","295111416493832851351525917352489409503","144061988706636402558768404894912910334","41760460526846914834539055097268522056","217374216991786881450675361491312209781","225644844904599433382574625748327210592","219175678001011742897453467129161423646","30139704971926640026947382836746770209","95812968352273376806464443778732007624","77724962621806154003135197500476925505","46971978458351870710934734332626456525","300287229516224976768868830287488887905","81397289336380612045933358636925899154"],"threshold":0.9},"id":"PUB-A-215912712-9acc40e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"},{"id":"PUB-A-215912712-ac70f148","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"onWindowRemoved"},"deprecated":false,"digest":{"length":218,"function_hash":"186121109985378599157501208163885875150"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"EmbeddedWindow"},"deprecated":false,"digest":{"length":391,"function_hash":"26648746563987095996461379873779715642"},"id":"PUB-A-215912712-b376891f","signature_type":"Function","signature_version":"v1"},{"id":"PUB-A-215912712-bf9de321","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"getSurfacePackage","file":"core/java/android/view/SurfaceControlViewHost.java"},"deprecated":false,"digest":{"length":244,"function_hash":"98708224717726924774764348833435963988"}},{"deprecated":true,"digest":{"function_hash":"92553313247997798040609520744226570560","length":132},"id":"PUB-A-215912712-d2e122fb","match_only_versions":["12L-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"file":"core/java/android/view/WindowlessWindowManager.java","function":"grantInputChannel"}},{"target":{"function":"grantInputChannel","file":"services/core/java/com/android/server/wm/Session.java"},"deprecated":false,"digest":{"length":687,"function_hash":"160158412850212107467758691652300779593"},"id":"PUB-A-215912712-de1f782b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"},{"digest":{"length":676,"function_hash":"77530300094508597560504939843687018762"},"id":"PUB-A-215912712-fcacd78e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced","target":{"function":"grantInputChannel","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"line_hashes":["297132866356129439650247628412132940206","303174920548254133121225758823063549256","109557742843025099762672170855687702934","69973829266395234888277497072107976292","249843219509874571401603772089555660062","24653710417627992956245966885794157113","169040677913424862085535237249480690499","249907199183291378187878039204653452548","3749866508948667195742557577011334333","77263441175257790732450424250028220505","177957622856663355899147648742363637241","243921429939073473608254175591894653936","73707595581636883795601674902081331902","4506747250339806290505252663755546936","257092041894948712891274309638591096779","158119484667052230678308897110627972593","19949290075548675480522230015399142402","320419642726364248892969374714882777180","326676554179258231367588427284393663671","330867935844262064784760523924163530486","188440502342548759644947147361175416830","33992531273419836881674858884998877764","97908565003288610906637655430332640527","150843986792921702356071417120635481502","150793315461927662885318269813241933294","213615006389502183952880584716324614454","80968761831915418500289429567873788165","12145204086282955014349739303453612196","203229796909502848305444347090942722171","141619099370849310620842390982148257973","233378015265758761875105831540848551973","211690972711465642056024996780188750480","300367417729140805075720897656647256933","80856441254202053371134967527393534949","150965068896732489751237879777463821566"],"threshold":0.9},"id":"PUB-A-215912712-ff232fc1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/501ee91b957eab6feb05832168573f51573efced"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-215912712.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"spl":"2022-06-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"grantEmbeddedWindowFocus"},"deprecated":false,"digest":{"length":1261,"function_hash":"41536229982092627211510767755923860933"},"id":"PUB-A-215912712-007d80e2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"core/java/android/view/SurfaceControlViewHost.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["302683034652937452900628729601447549231","158128491441815658791342111857597565896","271891907010357256944909752456134547362","166196354098175011428128008778447424562"]},"id":"PUB-A-215912712-099d0475","signature_type":"Line"},{"digest":{"function_hash":"327314395368691267019181232171994743816","length":225},"id":"PUB-A-215912712-211f27d3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"function":"getSurfacePackage","file":"core/java/android/view/SurfaceControlViewHost.java"},"deprecated":false},{"id":"PUB-A-215912712-42e463da","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"function":"addToDisplay","file":"core/java/android/view/WindowlessWindowManager.java"},"deprecated":false,"digest":{"length":1363,"function_hash":"173568828509927570143806274639106458779"}},{"digest":{"line_hashes":["111122913986043214337648687681084523164","299774918102398556928784908050133470352","6118059391038327457806559238760912538","278458067052608528666234082641956102942","323613906290305568114569722105271513615","277319330415602910703870405813293221247","280131073050254959127190007161039388685","17872331650406894598956152418694951647","205576568369135978193934845198033430771","231713717433687464958838342660489226126","170663188789405533190498353211788284081","77947182356533165268875933500400719804","307417433900226098033894432326852079901","47964460560293716390272378901255958953","106587980582975620963396486030542256532","243274474365661135643073550980233253258","122298865036439001389740065468810292055","122887771776450033160385624682157852669","319174063616503398322351737414644904754","101923151356666984389465939473999578357","221684015862223591517238411370451932655","252476985300961096795137545560356861557","229223661845914667207247256007332721838","144213558391825386109111068533916020348","74727407718073676886435133196161375478","170707037861298190245756413651016137213","26609651521637561229538402660244344452","33233242482048226665974689942252263718","199944379225751195658832412295287763010","229075557150457164382327372980894757376","295111416493832851351525917352489409503","144061988706636402558768404894912910334","41760460526846914834539055097268522056","217374216991786881450675361491312209781","225644844904599433382574625748327210592","301805550987279409476442288355885224500","222161618221220840631760989975349084042","162681521926766269886096507735316650239"],"threshold":0.9},"id":"PUB-A-215912712-7d12e30b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"160158412850212107467758691652300779593","length":687},"id":"PUB-A-215912712-86f8d43e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"function":"grantInputChannel","file":"services/core/java/com/android/server/wm/Session.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"EmbeddedWindow"},"deprecated":false,"digest":{"function_hash":"26648746563987095996461379873779715642","length":391},"id":"PUB-A-215912712-899e055c"},{"id":"PUB-A-215912712-89a3e9c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/Session.java"},"deprecated":false,"digest":{"line_hashes":["307975587768630657536385743269940051042","129571895563961595208330825225029915569","120489534548518309952564322799305312665","27445558377941926899303527121623302029","83009492359691535269599834475066089122","242363125001361202027442195738523802670","193430401147455584132599762128029672180","252307567104734172389202811549445370403"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"core/java/android/view/WindowlessWindowManager.java","function":"grantInputChannel"},"deprecated":false,"digest":{"length":132,"function_hash":"92553313247997798040609520744226570560"},"id":"PUB-A-215912712-8b2aa214","match_only_versions":["12L"],"signature_type":"Function"},{"id":"PUB-A-215912712-9d25e5f7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"line_hashes":["297132866356129439650247628412132940206","303174920548254133121225758823063549256","109557742843025099762672170855687702934","69973829266395234888277497072107976292","249843219509874571401603772089555660062","24653710417627992956245966885794157113","169040677913424862085535237249480690499","249907199183291378187878039204653452548","324622590527739428022368288448460476744","77263441175257790732450424250028220505","177957622856663355899147648742363637241","243921429939073473608254175591894653936","73707595581636883795601674902081331902","4506747250339806290505252663755546936","257092041894948712891274309638591096779","158119484667052230678308897110627972593","19949290075548675480522230015399142402","320419642726364248892969374714882777180","326676554179258231367588427284393663671","330867935844262064784760523924163530486","188440502342548759644947147361175416830","33992531273419836881674858884998877764","97908565003288610906637655430332640527","150843986792921702356071417120635481502","150793315461927662885318269813241933294","213615006389502183952880584716324614454","80968761831915418500289429567873788165","12145204086282955014349739303453612196","203229796909502848305444347090942722171","141619099370849310620842390982148257973","233378015265758761875105831540848551973","211690972711465642056024996780188750480","300367417729140805075720897656647256933","80856441254202053371134967527393534949","150965068896732489751237879777463821566"],"threshold":0.9}},{"digest":{"length":218,"function_hash":"186121109985378599157501208163885875150"},"id":"PUB-A-215912712-acac71ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"onWindowRemoved"},"deprecated":false},{"digest":{"line_hashes":["179833870550299361643224658453058537731","115056053776719773274087558906609198121","135902169074890242786529065395667085453","30187238928623378357292221212913018032","158500292227387259793422493870531899135","157473994530248800087446969901926750414","3554624916982651199122831179499286397","5373408571869161308241790047671666283","151079383664186564391149394501436141730","308002791425092254437893004673275369641","143086098992670610811390418642917599747","226688251488303744678384744181807250507","28744171646912162897373354997722176788","183248130313831857096967850360844829331","264679056851131321556390357525872630029","244506510009072707629547047307058480209","5484813515024828678280736639974151607","98168165945816108946915812514391913682","32864287871794712483081317261691410616","307975587768630657536385743269940051042","76122052778904437714693575498100955843","48033696707075702793373996737808958665"],"threshold":0.9},"id":"PUB-A-215912712-ad347b66","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"core/java/android/view/WindowlessWindowManager.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"remove"},"deprecated":false,"digest":{"function_hash":"267065823521529045684033885819322014145","length":248},"id":"PUB-A-215912712-bdd0f011"},{"deprecated":false,"digest":{"function_hash":"266004004414100078218679146360425037684","length":309},"id":"PUB-A-215912712-cae161ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/EmbeddedWindowController.java","function":"add"}},{"deprecated":false,"digest":{"length":1355,"function_hash":"307620882436853427180252805866804008327"},"id":"PUB-A-215912712-d3ce9732","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"grantEmbeddedWindowFocus"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"grantInputChannel"},"deprecated":false,"digest":{"function_hash":"77530300094508597560504939843687018762","length":676},"id":"PUB-A-215912712-e347dc5d"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0cfda55b95e842d7a90548de80292576bf5a0bd9"],"severity":"Moderate"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-215912712.json"}}],"schema_version":"1.9.0"}