{"id":"PUB-A-235100180","details":"In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-235100180","CVE-2022-20536"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/ims/+/1a3d0d5bb846e8313bfe5219181afc8b1d1cfb21"}],"affected":[{"package":{"name":"platform/external/ims","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/ims/+/1a3d0d5bb846e8313bfe5219181afc8b1d1cfb21"],"severity":"Moderate","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/ims/+/1a3d0d5bb846e8313bfe5219181afc8b1d1cfb21","target":{"file":"rcs/rcsservice/src/com/android/service/ims/RcsService.java"},"deprecated":false,"digest":{"line_hashes":["32667535482999251504552308217893029360","222843283158753581516402587015120573532","51443829663246950227140423887322028393","333655954522793867955443221285273009014"],"threshold":0.9},"id":"PUB-A-235100180-03275d38","match_only_versions":["13"],"signature_type":"Line"},{"target":{"function":"registerBroadcastReceiver","file":"rcs/rcsservice/src/com/android/service/ims/RcsService.java"},"deprecated":false,"digest":{"function_hash":"268927680633614983422039189214861129576","length":270},"id":"PUB-A-235100180-61be8729","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/ims/+/1a3d0d5bb846e8313bfe5219181afc8b1d1cfb21"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-235100180.json"}}],"schema_version":"1.9.0"}