{"id":"PUB-A-220733817","details":"In getAppSize of InstalldNativeService.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-220733817","CVE-2022-20201"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/81061238c19d7ebabb453697a8c643324cf6c68e"],"severity":"Moderate","spl":"2022-06-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81061238c19d7ebabb453697a8c643324cf6c68e","target":{"file":"cmds/installd/tests/installd_service_test.cpp"},"deprecated":false,"digest":{"line_hashes":["206110027184622951814648221017441832007","87352788869850329227676072270047846569","173370066077300292525950301471057070049","46393186790126271756704646185884947906"],"threshold":0.9},"id":"PUB-A-220733817-45f8efc8","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81061238c19d7ebabb453697a8c643324cf6c68e","target":{"file":"cmds/installd/InstalldNativeService.cpp"},"deprecated":false,"digest":{"line_hashes":["146002072713223434484532146433948274979","84076225174523120938269209848789376421","175028155982584189132141894810676055262","18693068090094971411136500265513945704"],"threshold":0.9},"id":"PUB-A-220733817-6018fbe8","match_only_versions":["12L"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-220733817.json"}}],"schema_version":"1.9.0"}