{"id":"PUB-A-238602879", "published":"2022-12-01T00:00:00Z", "modified":"2026-07-10T15:26:01.587957612Z", "aliases":["CVE-2022-20512", "A-238602879"], "details":"In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"13:0"}, {"fixed":"13:2022-12-01"}]}], "versions":["13"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10"], "severity":"Moderate", "spl":"2022-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["87023234758636688518580279742977847492", "156227951408008149834809767716402724201", "139538904288499720733161739059871245162", "17906862208350683992250854401296033418", "18570516621411759979227798673153229010", "62939044643125166266960321315167273467", "325506342793831268866187749169094700697", "128557412904820919273039029231580412176", "53298215061424404130679366970089834771", "237293726578278862743492198370101092423", "338938134932563759249131400322763920224", "25420170227652838024166694697780244688", "88372360178374856683271211677692117338", "290662778995779118785300837761397747970", "132350304773521846314295717061613364331", "328504435574437078211190151648417571967", "122781516842314321148626743446737549504", "214483010262324132343025915366814790676", "52168654157603053583445468678094860297", "12529517412027992795308357350496645327", "43910844674588589681746577153810251861", "328071507593102006017421473658828670766", "167036411047712391975502344021954460322", "276223985194962337881169963514332698391", "60398313064302945078369980694065506932", "198717170560423248128880402600788625734", "5812219054698407678957203650405056987", "15374866258333306775744673837346384118", "319632001533401223903935507899340528659"], "threshold":0.9}, "id":"PUB-A-238602879-32c625b9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"services/core/java/com/android/server/wm/Task.java"}}, {"deprecated":false, "digest":{"line_hashes":["306559393022413925382155773692320296384", "238960534496907325979934580275291698422", "169188590464448337574821319562833570629", "78745171192634581654606904275711492068", "53788038157245073677564316840809908521"], "threshold":0.9}, "id":"PUB-A-238602879-3b26aeba", "match_only_versions":["13"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"core/java/android/app/Activity.java"}}, {"deprecated":false, "digest":{"line_hashes":["282781627699296836975327025386161346934", "42094766961544345880972979640642786933", "250550536400353281549849636313870821883", "290482630999081124066155995341611557341", "236854611551494729720537003077808950778", "120524270434374463572634767311078181470", "162774942616731393439321803859546688995", "249567687540557912646933735048079729022"], "threshold":0.9}, "id":"PUB-A-238602879-4c43d792", "match_only_versions":["13"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"core/java/android/app/ActivityClient.java"}}, {"deprecated":false, "digest":{"function_hash":"91395776182192251487408040872637904378", "length":558}, "id":"PUB-A-238602879-6431ec59", "match_only_versions":["13"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"core/java/android/app/Activity.java", "function":"navigateUpTo"}}, {"deprecated":false, "digest":{"function_hash":"307238130757706282620781154472359191247", "length":2999}, "id":"PUB-A-238602879-8eb4c0c3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"services/core/java/com/android/server/wm/Task.java", "function":"navigateUpTo"}}, {"deprecated":false, "digest":{"line_hashes":["43236168583164607272166184699747538749", "112539726971416951003819936074542494816", "11679931484379987831102043081266917436", "96198931258405865349890283898157425465", "247847563746743205079531358196549504093", "211702326257149068260973419647808809405", "128223971925101955697380962639458389835", "70871824146377541733704190391174489597", "119710023312408707206073918279139011674"], "threshold":0.9}, "id":"PUB-A-238602879-8f426356", "match_only_versions":["13"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}, {"deprecated":false, "digest":{"function_hash":"206418071082596740030823545870001781072", "length":439}, "id":"PUB-A-238602879-f440e919", "match_only_versions":["13"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d75844cf9a60c1380495182ca9867af5cc4beb10", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java", "function":"navigateUpTo"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2022-12-01"}]}