{"id":"ASB-A-219546241", "published":"2022-08-01T00:00:00Z", "modified":"2026-05-01T15:24:27.653932157Z", "aliases":["CVE-2022-20354", "A-219546241"], "details":"In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2022-08-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758"], "severity":"High", "spl":"2022-08-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"193868602843362343899007770877667317522", "length":1069}, "id":"ASB-A-219546241-137c4f7d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java", "function":"onDefaultNetworkChanged"}}, {"deprecated":false, "digest":{"line_hashes":["78555699897782305379299991539925082044", "69813932820980907898905871784079220126", "277777423725206526745439767517869962662"], "threshold":0.9}, "id":"ASB-A-219546241-96692bca", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-08-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758"], "severity":"High", "spl":"2022-08-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"193868602843362343899007770877667317522", "length":1069}, "id":"ASB-A-219546241-3bd66811", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java", "function":"onDefaultNetworkChanged"}}, {"deprecated":false, "digest":{"line_hashes":["78555699897782305379299991539925082044", "69813932820980907898905871784079220126", "277777423725206526745439767517869962662"], "threshold":0.9}, "id":"ASB-A-219546241-dc1bcd08", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-08-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758"], "severity":"High", "spl":"2022-08-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"193868602843362343899007770877667317522", "length":1069}, "id":"ASB-A-219546241-73fe7426", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java", "function":"onDefaultNetworkChanged"}}, {"deprecated":false, "digest":{"line_hashes":["78555699897782305379299991539925082044", "69813932820980907898905871784079220126", "277777423725206526745439767517869962662"], "threshold":0.9}, "id":"ASB-A-219546241-7c583321", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/65d44b93bb99eae441ebf5bf1afb4efd00074758", "target":{"file":"services/core/java/com/android/server/connectivity/Vpn.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-08-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/90fece0bec5e4d5c04c422d09c2122ac0b894da5"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/7e943a04c5f5c6a99292c0b0a8103307548cfd26"}]}