{"id":"ASB-A-203431023", "published":"2022-06-01T00:00:00Z", "modified":"2026-04-29T15:10:00.007170452Z", "aliases":["CVE-2022-20126", "A-203431023"], "details":"In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L-next:0"}, {"fixed":"12L-next:2022-06-01"}]}], "versions":["12L-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"306408796174320226647143357411811607888", "length":297}, "id":"ASB-A-203431023-0564ff75", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"setDiscoverableTimeout"}}, {"deprecated":false, "digest":{"line_hashes":["184196211465596637036676436981022160986", "310663038790803474228144224051457634065", "235200042516890789000893520623616856433", "74056111292228662419642069507111208323", "280865106268737356318352464790165724163", "31751067178526632610812621753358219135", "121380037984780544106085503251813162023", "115406219874387320131559651200307225012", "202006277810136237772203677493381325889", "184997035097119368774453889288419654155", "228403452926252819945841653792026404095", "79357729360616193902807655643700292302", "53073610528342643939637634752102331140", "233298843227634921828128355666204684003", "129041647635244075524337653918275144826", "201497200635376658514585156517811832238", "299108017017304219847357040897943149945", "26336067661531312286298575742099149644", "216431135408102165191893687207576056864", "176281420003676838415340115292266963530", "219325013445161890951510386503674400884", "231031870505611136751596413830225061327", "73397768373368757536479802789304542650", "86297380719523360092289164958136849650", "96504084766857505299204479415726309676", "160057590753693384341480522250881637743", "1133394177015753540700299389162097589", "252693157415961571234960786732231294635", "325256900392167122739568556677971918605", "59383564349327758604786432256412400049", "97788076907198308619448996106236548653", "259482035435254778313450921017276894325"], "threshold":0.9}, "id":"ASB-A-203431023-0f43b4af", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"337355188220726876884449145526534949697", "length":273}, "id":"ASB-A-203431023-57193b34", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"getDiscoverableTimeout"}}, {"deprecated":false, "digest":{"function_hash":"224398954382340583561811694483425651957", "length":350}, "id":"ASB-A-203431023-da1724b4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e208fcf394b9591a41250de8ee8bdad3bd9af558", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"setScanMode"}}]}}, {"package":{"name":"platform/packages/apps/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2022-06-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["236829967481794875659806067643400471350", "221889625477845835155469983470567822437", "318959092762556263064621329974291824841", "108872696766585779850438660990602331717"], "threshold":0.9}, "id":"ASB-A-203431023-7888c779", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"339203127178591143702063251470082974776", "length":209}, "id":"ASB-A-203431023-a11e83cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/95cbb22647ef5e4505f64d97b7dcbfad2a9fb0e0", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java", "function":"setScanMode"}}]}}, {"package":{"name":"platform/packages/apps/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2022-06-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/649612a49791564b43e6f5d41cb4a5ae07d94394"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["284189501339935948702336696034543302981", "20429472355090212643904629645984168325", "92254625992077032004077375276068304370", "310656572878670007030099036643950233342"], "threshold":0.9}, "id":"ASB-A-203431023-a5b6da18", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/649612a49791564b43e6f5d41cb4a5ae07d94394", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"}}]}}, {"package":{"name":"platform/packages/apps/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-06-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["115406219874387320131559651200307225012", "202006277810136237772203677493381325889", "184997035097119368774453889288419654155"], "threshold":0.9}, "id":"ASB-A-203431023-9bd93427", "match_only_versions":["12"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"224398954382340583561811694483425651957", "length":350}, "id":"ASB-A-203431023-aa617f78", "match_only_versions":["12"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java", "function":"setScanMode"}}]}}, {"package":{"name":"platform/packages/apps/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-06-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["115406219874387320131559651200307225012", "202006277810136237772203677493381325889", "184997035097119368774453889288419654155"], "threshold":0.9}, "id":"ASB-A-203431023-829ae564", "match_only_versions":["12L"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"224398954382340583561811694483425651957", "length":350}, "id":"ASB-A-203431023-ff5778ad", "match_only_versions":["12L"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae", "target":{"file":"src/com/android/bluetooth/btservice/AdapterService.java", "function":"setScanMode"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e49e5dc377dd39c523c287b71c0831159e2cc6ae"}]}