PT-2022-14684 · Google · Android

Published

2022-11-01

·

Updated

2026-05-27

·

CVE-2022-20465

CVSS v3.1

4.6

Medium

VectorAV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Android versions 10 through 13
Description A logic error in the code of KeyguardHostViewController.java and related files allows for a possible lockscreen bypass, leading to local escalation of privilege with no additional execution privileges needed. This issue can be exploited without user interaction. The vulnerability can be triggered by inserting a new SIM card, entering the incorrect PIN three times, and then entering the PUK code, which grants full access to the device without requiring the password or unlock pattern. The issue is caused by an error in the dismiss() function, which is intended to close the current security screen but instead closes the PIN/password screen, resulting in the device being unlocked.
Recommendations For Android versions 10 through 13, update to the November security patch or later to resolve the issue. As a temporary workaround, consider disabling the SIM card lock feature to minimize the risk of exploitation. Restrict physical access to devices to prevent potential attackers from inserting a new SIM card and exploiting the vulnerability.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ASB-A-218500036
CVE-2022-20465

Affected Products

Android