{"id":"ASB-A-231496105", "published":"2022-12-01T00:00:00Z", "modified":"2026-05-01T15:24:27.653932157Z", "aliases":["CVE-2022-20240", "A-231496105"], "details":"In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-12-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/25f1b6a1ac5c71ebafe4b9235829aa3a79d1dd21", "https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0"], "severity":"High", "spl":"2022-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["168149929116503664461813113991766821421", "139436274516220223698822537870033012269", "246355147872454468010446409861288447715", "165462986073571324282044550197153947044", "260275766334139120717668833150014759553", "191715191793205716465398872182497785380", "302429306498499206515073086888635841509", "28034202699633924377934181069895711517", "304157201227273680580054751271425893556"], "threshold":0.9}, "id":"ASB-A-231496105-18883cf2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}, {"deprecated":false, "digest":{"line_hashes":["333004141841961389172620261135932749679", "89857665520800945892087856214709785240", "174016828635114852806756382166578884954", "213848584682783567061178554717581727214", "213848584682783567061178554717581727214", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "178685420952493366161151037228173587357", "323862811657808820199895429461449033295", "172851754198710831360208205726140696844", "74319369933616512803145640709357483775", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "94297448559448385734258709756561109635", "183571857917098355995430059067945437895", "231355718516759045925096208710506966753", "190910644323319203016238796257233780346", "50456745090508302344516703751629959346", "170003216249822339875418858001180536222", "292885038649111259090236445317783673249", "267789059819050148366529019044926381509", "299670398654766460699254033246307703285", "130657974524070960929315722170793224076", "290131175657484087281470637668357524752"], "threshold":0.9}, "id":"ASB-A-231496105-3c78d917", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"core/java/android/app/AppOpsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"88897209084590087665922884696267447625", "length":254}, "id":"ASB-A-231496105-6b8d6473", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"getBypassforPackage"}}, {"deprecated":false, "digest":{"function_hash":"43231089065105065375524541040624287164", "length":870}, "id":"ASB-A-231496105-c032a70c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"isOpRestrictedLocked"}}, {"deprecated":false, "digest":{"line_hashes":["111400768076500226407069141782556351593", "216560180838675918637853852682089799365", "245917168920956267784996242616646963509", "217963627627744030253978043159836926092", "5713013725955715142044643145842555623"], "threshold":0.9}, "id":"ASB-A-231496105-d5648fab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0", "target":{"file":"core/java/android/app/AppOpsManager.java"}}]}}, {"package":{"name":"platform/packages/modules/Wifi", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-12-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4"], "severity":"High", "spl":"2022-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"289139114456010572259566462303694312588", "length":617}, "id":"ASB-A-231496105-2c256e50", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"enforceCanAccessScanResultsForWifiScanner"}}, {"deprecated":false, "digest":{"function_hash":"15397169924466002301048257008193050167", "length":432}, "id":"ASB-A-231496105-61a65270", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"checkCallersFineLocationPermission"}}, {"deprecated":false, "digest":{"line_hashes":["19831358299399943583179334296197055302", "183777785248348122401683106955805939399", "34075110875282535618572364503116820625", "247803289308958939041313306699509699419", "154623075196566111406704057886519803576", "62690225152807030669126704139162043551", "68306262298392969082445863401888039282", "72475156664686923119041247043727751716", "53993378455130952313152206341020572204", "81540051439898314215456154076814595112", "211507552307243013600710597175584004355", "157840185077450552434100864470314368598", "169694829992740909101504239054484510359", "134200273278587846242394943687284927829", "178676600666870987897513653437137811294", "115987511841326095703745783191813255302", "312573181804635896214101030778605107635", "293915166135138036783114045682045344058", "173004159169691864231757072185567661756", "258442460609758662950587633301727304722", "329721609069990995037800649952180937626", "262173981762223836348503790980049514413", "199702937687716993582515676020963864702", "79467151087155781976771431713371866330", "141790706957766889774652427778336981928"], "threshold":0.9}, "id":"ASB-A-231496105-705766da", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"318220793797999637493299458924580349849", "length":213}, "id":"ASB-A-231496105-f3eb1cfb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"enforceFineLocationPermission"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-12-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/25f1b6a1ac5c71ebafe4b9235829aa3a79d1dd21", "https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0"], "severity":"High", "spl":"2022-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["168149929116503664461813113991766821421", "139436274516220223698822537870033012269", "246355147872454468010446409861288447715", "165462986073571324282044550197153947044", "260275766334139120717668833150014759553", "191715191793205716465398872182497785380", "302429306498499206515073086888635841509", "28034202699633924377934181069895711517", "304157201227273680580054751271425893556"], "threshold":0.9}, "id":"ASB-A-231496105-2affead7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}, {"deprecated":false, "digest":{"function_hash":"88897209084590087665922884696267447625", "length":254}, "id":"ASB-A-231496105-5cc63c46", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"getBypassforPackage"}}, {"deprecated":false, "digest":{"function_hash":"43231089065105065375524541040624287164", "length":870}, "id":"ASB-A-231496105-5eb3db38", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"isOpRestrictedLocked"}}, {"deprecated":false, "digest":{"line_hashes":["333004141841961389172620261135932749679", "89857665520800945892087856214709785240", "174016828635114852806756382166578884954", "213848584682783567061178554717581727214", "213848584682783567061178554717581727214", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "178685420952493366161151037228173587357", "323862811657808820199895429461449033295", "172851754198710831360208205726140696844", "74319369933616512803145640709357483775", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "58512286477795118794937599630399416946", "250097779096880568101066423653481917828", "40187803491564778987740340096908997809", "5713013725955715142044643145842555623", "94297448559448385734258709756561109635", "183571857917098355995430059067945437895", "231355718516759045925096208710506966753", "190910644323319203016238796257233780346", "50456745090508302344516703751629959346", "170003216249822339875418858001180536222", "292885038649111259090236445317783673249", "267789059819050148366529019044926381509", "299670398654766460699254033246307703285", "130657974524070960929315722170793224076", "290131175657484087281470637668357524752"], "threshold":0.9}, "id":"ASB-A-231496105-be145f62", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1dddfe1f703cab6e159fafad45f51e8bad207dba", "target":{"file":"core/java/android/app/AppOpsManager.java"}}, {"deprecated":false, "digest":{"line_hashes":["111400768076500226407069141782556351593", "216560180838675918637853852682089799365", "245917168920956267784996242616646963509", "217963627627744030253978043159836926092", "5713013725955715142044643145842555623"], "threshold":0.9}, "id":"ASB-A-231496105-feea00e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/807f4cfc80728313d04f95343e5aea14691aceb0", "target":{"file":"core/java/android/app/AppOpsManager.java"}}]}}, {"package":{"name":"platform/packages/modules/Wifi", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-12-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4"], "severity":"High", "spl":"2022-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"289139114456010572259566462303694312588", "length":617}, "id":"ASB-A-231496105-2a368379", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"enforceCanAccessScanResultsForWifiScanner"}}, {"deprecated":false, "digest":{"line_hashes":["19831358299399943583179334296197055302", "183777785248348122401683106955805939399", "34075110875282535618572364503116820625", "247803289308958939041313306699509699419", "154623075196566111406704057886519803576", "62690225152807030669126704139162043551", "68306262298392969082445863401888039282", "72475156664686923119041247043727751716", "53993378455130952313152206341020572204", "81540051439898314215456154076814595112", "211507552307243013600710597175584004355", "157840185077450552434100864470314368598", "169694829992740909101504239054484510359", "134200273278587846242394943687284927829", "178676600666870987897513653437137811294", "115987511841326095703745783191813255302", "312573181804635896214101030778605107635", "293915166135138036783114045682045344058", "173004159169691864231757072185567661756", "258442460609758662950587633301727304722", "329721609069990995037800649952180937626", "262173981762223836348503790980049514413", "199702937687716993582515676020963864702", "79467151087155781976771431713371866330", "141790706957766889774652427778336981928"], "threshold":0.9}, "id":"ASB-A-231496105-772ac495", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"318220793797999637493299458924580349849", "length":213}, "id":"ASB-A-231496105-c91dd05a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"enforceFineLocationPermission"}}, {"deprecated":false, "digest":{"function_hash":"15397169924466002301048257008193050167", "length":432}, "id":"ASB-A-231496105-d65ae10d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Wifi/+/ad066708162beacd942e3750fa253178093b78b4", "target":{"file":"service/java/com/android/server/wifi/util/WifiPermissionsUtil.java", "function":"checkCallersFineLocationPermission"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-12-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/61c2d0291bd5b9b39a1d7db7454b3d7c630e7de9"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/cad40dc9b13596b85df5a41b25fc07c0854dc65a"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/530407c903c3b06c6bd0a423937531f95eb116ae"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/modules/Wifi/+/bb99dc7a9e5c6b14f672ee12c6e4093803b8b915"}]}