{"id":"ASB-A-235098883", "published":"2022-11-01T00:00:00Z", "modified":"2026-04-29T15:10:00.007170452Z", "aliases":["CVE-2022-20451", "A-235098883"], "details":"In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2022-11-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/d80cf1a7b71119e6843f2ee3e43f8c49f6bf3f54"], "severity":"High", "spl":"2022-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["90318205065606561043884690310810845677", "136994689380649245360518211420121968453", "298740314377000020502263473144852808838", "21387850157299654266101515218898453776", "250733354817558946597434227752831285804", "323029196704237783690810370671001093584", "56609536568271248166245200469451222536", "70617805874188584440178893864371025281", "145050397850970283445092671007393099435", "325460288744236392637473733485734496931", "120554692771712425450164883798148210965", "216753325627485995622306550072138495563", "310419024130454413646494475091772126323", "128375389671755078266861537160023294952", "163232583368852320667111453582922645589", "14284280858149685098989265174006597933", "17569772172361472032489349891596062196", "309870465881777670000889058642353937880", "202637388650123876466385843878974427368", "186030785590081878932242815522794011201", "130567286403321222431699522616763289847"], "threshold":0.9}, "id":"ASB-A-235098883-19ab49e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d80cf1a7b71119e6843f2ee3e43f8c49f6bf3f54", "target":{"file":"src/com/android/server/telecom/CallsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"241754292414573096411305693026388168696", "length":3306}, "id":"ASB-A-235098883-1a1613ed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d80cf1a7b71119e6843f2ee3e43f8c49f6bf3f54", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"onCallRedirectionComplete"}}, {"deprecated":false, "digest":{"function_hash":"136016856945005241622357145227811723443", "length":129}, "id":"ASB-A-235098883-433742f4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d80cf1a7b71119e6843f2ee3e43f8c49f6bf3f54", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}, {"deprecated":false, "digest":{"function_hash":"56996565309622859199760986891345043267", "length":211}, "id":"ASB-A-235098883-fd875d89", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d80cf1a7b71119e6843f2ee3e43f8c49f6bf3f54", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"11:0"}, {"fixed":"11:2022-11-01"}]}], "versions":["11"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/256ef21f54f70e5b3d32058806ceeff546d7e07a"], "severity":"High", "spl":"2022-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"182971787671837446836215734929938011431", "length":3013}, "id":"ASB-A-235098883-286bf0d5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/256ef21f54f70e5b3d32058806ceeff546d7e07a", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"onCallRedirectionComplete"}}, {"deprecated":false, "digest":{"line_hashes":["90318205065606561043884690310810845677", "5796137444434912928138706482082313920", "49476044142096104189746131419820537579", "126291089231107155096707050100944468383", "250733354817558946597434227752831285804", "323029196704237783690810370671001093584", "56609536568271248166245200469451222536", "246107628532541466110725314629604045334", "75637455373044755721658173082363347420", "183612808229199593950615287424797619157", "120554692771712425450164883798148210965", "216753325627485995622306550072138495563", "310419024130454413646494475091772126323", "128375389671755078266861537160023294952", "163232583368852320667111453582922645589", "14284280858149685098989265174006597933", "17569772172361472032489349891596062196", "309870465881777670000889058642353937880", "202637388650123876466385843878974427368", "186030785590081878932242815522794011201", "130567286403321222431699522616763289847"], "threshold":0.9}, "id":"ASB-A-235098883-a7588d8b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/256ef21f54f70e5b3d32058806ceeff546d7e07a", "target":{"file":"src/com/android/server/telecom/CallsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"56996565309622859199760986891345043267", "length":211}, "id":"ASB-A-235098883-c0b32164", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/256ef21f54f70e5b3d32058806ceeff546d7e07a", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}, {"deprecated":false, "digest":{"function_hash":"136016856945005241622357145227811723443", "length":129}, "id":"ASB-A-235098883-e8aa6a17", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/256ef21f54f70e5b3d32058806ceeff546d7e07a", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12:0"}, {"fixed":"12:2022-11-01"}]}], "versions":["12"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/6b0e9b46adcb7af1fcc19a92fc887e1b6ee19921"], "severity":"High", "spl":"2022-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"304563262180663244574201306052709331678", "length":3065}, "id":"ASB-A-235098883-53a23ec8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6b0e9b46adcb7af1fcc19a92fc887e1b6ee19921", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"onCallRedirectionComplete"}}, {"deprecated":false, "digest":{"line_hashes":["90318205065606561043884690310810845677", "5796137444434912928138706482082313920", "49476044142096104189746131419820537579", "126291089231107155096707050100944468383", "250733354817558946597434227752831285804", "323029196704237783690810370671001093584", "56609536568271248166245200469451222536", "246107628532541466110725314629604045334", "75637455373044755721658173082363347420", "183612808229199593950615287424797619157", "120554692771712425450164883798148210965", "216753325627485995622306550072138495563", "310419024130454413646494475091772126323", "128375389671755078266861537160023294952", "163232583368852320667111453582922645589", "14284280858149685098989265174006597933", "17569772172361472032489349891596062196", "309870465881777670000889058642353937880", "202637388650123876466385843878974427368", "186030785590081878932242815522794011201", "130567286403321222431699522616763289847"], "threshold":0.9}, "id":"ASB-A-235098883-851a327c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6b0e9b46adcb7af1fcc19a92fc887e1b6ee19921", "target":{"file":"src/com/android/server/telecom/CallsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"136016856945005241622357145227811723443", "length":129}, "id":"ASB-A-235098883-9ac7a66d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6b0e9b46adcb7af1fcc19a92fc887e1b6ee19921", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}, {"deprecated":false, "digest":{"function_hash":"56996565309622859199760986891345043267", "length":211}, "id":"ASB-A-235098883-aa4e4e13", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6b0e9b46adcb7af1fcc19a92fc887e1b6ee19921", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"12L:0"}, {"fixed":"12L:2022-11-01"}]}], "versions":["12L"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126"], "severity":"High", "spl":"2022-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"304563262180663244574201306052709331678", "length":3065}, "id":"ASB-A-235098883-61ff9f53", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"onCallRedirectionComplete"}}, {"deprecated":false, "digest":{"function_hash":"136016856945005241622357145227811723443", "length":129}, "id":"ASB-A-235098883-6cbe5bc8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}, {"deprecated":false, "digest":{"line_hashes":["90318205065606561043884690310810845677", "5796137444434912928138706482082313920", "49476044142096104189746131419820537579", "126291089231107155096707050100944468383", "250733354817558946597434227752831285804", "323029196704237783690810370671001093584", "56609536568271248166245200469451222536", "246107628532541466110725314629604045334", "75637455373044755721658173082363347420", "183612808229199593950615287424797619157", "120554692771712425450164883798148210965", "216753325627485995622306550072138495563", "310419024130454413646494475091772126323", "128375389671755078266861537160023294952", "163232583368852320667111453582922645589", "14284280858149685098989265174006597933", "17569772172361472032489349891596062196", "309870465881777670000889058642353937880", "202637388650123876466385843878974427368", "186030785590081878932242815522794011201", "130567286403321222431699522616763289847"], "threshold":0.9}, "id":"ASB-A-235098883-874a75b4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"56996565309622859199760986891345043267", "length":211}, "id":"ASB-A-235098883-db64cde6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"13:0"}, {"fixed":"13:2022-11-01"}]}], "versions":["13"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126"], "severity":"High", "spl":"2022-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"56996565309622859199760986891345043267", "length":211}, "id":"ASB-A-235098883-46317b98", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}, {"deprecated":false, "digest":{"line_hashes":["90318205065606561043884690310810845677", "5796137444434912928138706482082313920", "49476044142096104189746131419820537579", "126291089231107155096707050100944468383", "250733354817558946597434227752831285804", "323029196704237783690810370671001093584", "56609536568271248166245200469451222536", "246107628532541466110725314629604045334", "75637455373044755721658173082363347420", "183612808229199593950615287424797619157", "120554692771712425450164883798148210965", "216753325627485995622306550072138495563", "310419024130454413646494475091772126323", "128375389671755078266861537160023294952", "163232583368852320667111453582922645589", "14284280858149685098989265174006597933", "17569772172361472032489349891596062196", "309870465881777670000889058642353937880", "202637388650123876466385843878974427368", "186030785590081878932242815522794011201", "130567286403321222431699522616763289847"], "threshold":0.9}, "id":"ASB-A-235098883-5504693d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java"}}, {"deprecated":false, "digest":{"function_hash":"304563262180663244574201306052709331678", "length":3065}, "id":"ASB-A-235098883-89c09440", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"onCallRedirectionComplete"}}, {"deprecated":false, "digest":{"function_hash":"136016856945005241622357145227811723443", "length":129}, "id":"ASB-A-235098883-e2817f25", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/735b84a90e5305915836329d4abca672fcc87126", "target":{"file":"src/com/android/server/telecom/CallsManager.java", "function":"loggedRun"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9c4fc215ebb32b2c71e368ca2aca13d0f18d637d"}]}