{"id":"ASB-A-154915372", "published":"2020-12-01T00:00:00Z", "modified":"2026-06-08T15:01:31.246215948Z", "aliases":["CVE-2020-0294", "A-154915372"], "details":"In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.0:0"}, {"fixed":"8.0:2020-12-01"}]}], "versions":["8.0"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0"], "severity":"High", "spl":"2020-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"84416793346937767167254471141091045254", "length":4048}, "id":"ASB-A-154915372-ce4db10d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java", "function":"bindWallpaperComponentLocked"}}, {"deprecated":false, "digest":{"line_hashes":["170528186882576145372200036566958566704", "281483566740986442556884866163440144291", "290795121936613533827252059507148797625", "253239195638038181649858847663911923827"], "threshold":0.9}, "id":"ASB-A-154915372-ee67fab6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.1:0"}, {"fixed":"8.1:2020-12-01"}]}], "versions":["8.1"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0"], "severity":"High", "spl":"2020-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"84416793346937767167254471141091045254", "length":4048}, "id":"ASB-A-154915372-3504ab45", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java", "function":"bindWallpaperComponentLocked"}}, {"deprecated":false, "digest":{"line_hashes":["170528186882576145372200036566958566704", "281483566740986442556884866163440144291", "290795121936613533827252059507148797625", "253239195638038181649858847663911923827"], "threshold":0.9}, "id":"ASB-A-154915372-db684b7f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"9:0"}, {"fixed":"9:2020-12-01"}]}], "versions":["9"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0"], "severity":"High", "spl":"2020-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["170528186882576145372200036566958566704", "281483566740986442556884866163440144291", "290795121936613533827252059507148797625", "253239195638038181649858847663911923827"], "threshold":0.9}, "id":"ASB-A-154915372-833bac1a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"84416793346937767167254471141091045254", "length":4048}, "id":"ASB-A-154915372-8c70a184", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java", "function":"bindWallpaperComponentLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2020-12-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0"], "severity":"High", "spl":"2020-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["170528186882576145372200036566958566704", "281483566740986442556884866163440144291", "290795121936613533827252059507148797625", "253239195638038181649858847663911923827"], "threshold":0.9}, "id":"ASB-A-154915372-44b53f5e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"84416793346937767167254471141091045254", "length":4048}, "id":"ASB-A-154915372-abb7273e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0", "target":{"file":"services/core/java/com/android/server/wallpaper/WallpaperManagerService.java", "function":"bindWallpaperComponentLocked"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2020-12-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/d4bd69cef05d379555418a8fe748ec94ff6bd6d0"}]}