{"id":"ASB-A-220303465", "published":"2022-06-01T00:00:00Z", "modified":"2026-05-01T15:24:27.653932157Z", "aliases":["CVE-2022-20135", "A-220303465"], "details":"In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L-next:0"}, {"fixed":"12L-next:2022-06-01"}]}], "versions":["12L-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/46653a91c30245ca29d41d69174813979a910496"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["36759195758799716500470339593499857914", "43508493706120780682209415994849481627", "42695536845890415653534672504368779046", "239175390438734679826583784887107075704"], "threshold":0.9}, "id":"ASB-A-220303465-82379a91", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/46653a91c30245ca29d41d69174813979a910496", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java"}}, {"deprecated":false, "digest":{"function_hash":"234721301296286211552937633209153828894", "length":387}, "id":"ASB-A-220303465-f0802882", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/46653a91c30245ca29d41d69174813979a910496", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2022-06-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["36759195758799716500470339593499857914", "43508493706120780682209415994849481627", "42695536845890415653534672504368779046", "239175390438734679826583784887107075704"], "threshold":0.9}, "id":"ASB-A-220303465-3d9cefd2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java"}}, {"deprecated":false, "digest":{"function_hash":"234721301296286211552937633209153828894", "length":387}, "id":"ASB-A-220303465-c6226601", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2022-06-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["36759195758799716500470339593499857914", "43508493706120780682209415994849481627", "42695536845890415653534672504368779046", "239175390438734679826583784887107075704"], "threshold":0.9}, "id":"ASB-A-220303465-54075721", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java"}}, {"deprecated":false, "digest":{"function_hash":"234721301296286211552937633209153828894", "length":387}, "id":"ASB-A-220303465-b54eaf70", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/658c53c47c0d1b6a74d3c0a72372aaaba16c2516", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-06-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["36759195758799716500470339593499857914", "43508493706120780682209415994849481627", "42695536845890415653534672504368779046", "239175390438734679826583784887107075704"], "threshold":0.9}, "id":"ASB-A-220303465-3e90c173", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java"}}, {"deprecated":false, "digest":{"function_hash":"234721301296286211552937633209153828894", "length":387}, "id":"ASB-A-220303465-7ed6e48a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-06-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760"], "severity":"High", "spl":"2022-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["36759195758799716500470339593499857914", "43508493706120780682209415994849481627", "42695536845890415653534672504368779046", "239175390438734679826583784887107075704"], "threshold":0.9}, "id":"ASB-A-220303465-6cefea16", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java"}}, {"deprecated":false, "digest":{"function_hash":"234721301296286211552937633209153828894", "length":387}, "id":"ASB-A-220303465-81c81dfb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760", "target":{"file":"core/java/android/service/gatekeeper/GateKeeperResponse.java", "function":"writeToParcel"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/5d2176df6923a8984e2b81d8eb4b728f01f1c760"}]}