{"id":"PUB-A-227470877","details":"In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-227470877","CVE-2022-20522"],"modified":"2026-05-01T15:24:27.653932Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/88037e4f5e05807db6c925bc5aeaf01f6276d4f9"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2022-12-01","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/88037e4f5e05807db6c925bc5aeaf01f6276d4f9"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","digest":{"function_hash":"64862335666524616398601377012350108103","length":45},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/88037e4f5e05807db6c925bc5aeaf01f6276d4f9","target":{"function":"getBackgroundWorkerClass","file":"src/com/android/settings/network/ProviderModelSlice.java"},"match_only_versions":["13"],"id":"PUB-A-227470877-3748ecad"},{"signature_type":"Function","signature_version":"v1","digest":{"function_hash":"182938360869102536702090534190159001943","length":1639},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/88037e4f5e05807db6c925bc5aeaf01f6276d4f9","target":{"function":"getSlice","file":"src/com/android/settings/network/ProviderModelSlice.java"},"match_only_versions":["13"],"id":"PUB-A-227470877-90f54a10"},{"signature_type":"Line","signature_version":"v1","digest":{"line_hashes":["20741715428782949172839944570700361480","127347408120081777186195359436228801116","295772450544397982666871347001313709839","106811892440021254914266515116531562853","123810973294163477280580869194466616064","46915905549989514722094856776514639136","308696907300406639402203287157887306902","317130395206895879527839019719622109982","187973733605461320876850578215322993905","160107659018104972416861561588338033294","35399368804301531544782259869389590435","34207970966674348164301538021069847548"],"threshold":0.9},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/88037e4f5e05807db6c925bc5aeaf01f6276d4f9","target":{"file":"src/com/android/settings/network/ProviderModelSlice.java"},"match_only_versions":["13"],"id":"PUB-A-227470877-cf9f1ff8"}],"severity":"Moderate","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227470877.json"}}],"schema_version":"1.7.5"}