{"id":"PUB-A-236264289","details":"In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-236264289","CVE-2022-20558"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2"}],"affected":[{"package":{"name":"platform/frameworks/opt/net/ims","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2"],"severity":"Moderate","spl":"2022-12-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17360799293048442066505985161950929115","328368001886009224069484841306278194830","99953689535948755601997894374607517785","195233620726160135965610573385735531249"]},"id":"PUB-A-236264289-12f945c0","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2","target":{"file":"src/java/com/android/ims/rcs/uce/presence/publish/DeviceCapabilityListener.java"}},{"deprecated":false,"digest":{"line_hashes":["162282707822528203542231119936839344072","23802815394259780986893727447244734264","52943098920708217744766365953400819717","87354709219545991944421374570804310995","332861751766177842396881569501310283291","133614099957187829240276545199366750583","221262851186960587110234639373538289996","255958958686956559658407877499037658582"],"threshold":0.9},"id":"PUB-A-236264289-3e1953b5","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2","target":{"file":"tests/src/com/android/ims/ContextFixture.java"}},{"digest":{"length":506,"function_hash":"229801768736183275224950774434043203122"},"id":"PUB-A-236264289-dbce3c83","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/net/ims/+/ed6a388e3f5a65065c11acd80f175b7e7169e9b2","target":{"file":"src/java/com/android/ims/rcs/uce/presence/publish/DeviceCapabilityListener.java","function":"registerReceivers"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-236264289.json"}}],"schema_version":"1.9.0"}