CVE-2022-20005: INSTALL_DONT_KILL_APP Vulnerability in Android Frameworks Base
Summary
CVE-2022-20005: In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . Affects platform/frameworks/base across 4 version ranges.
>= 10:0, < 10:2022-05-01
>= 11:0, < 11:2022-05-01
>= 12:0, < 12:2022-05-01
>= 12L:0, < 12L:2022-05-01
Fixed in 10:2022-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Android Frameworks Base is a core component of the Android operating system that provides essential functionalities and services for running applications. It includes various libraries and APIs for handling system resources, managing user interfaces, and facilitating communication between different components. Unfortunately, a vulnerability has been discovered in the PackageInstallerSession module of Android Frameworks Base, which allows for a mismatch between running code and a parsed APK. This vulnerability could potentially be exploited by a local attacker to escalate privileges without requiring user interaction.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20005, resides in the validateApkInstallLocked function of PackageInstallerSession.java. By leveraging the INSTALL_DONT_KILL_APP flag, an attacker can force a mismatch between the running code and the parsed APK. This mismatch can lead to local escalation of privilege, enabling the attacker to execute code with elevated privileges. The vulnerability affects Android versions 10, 11, 12, and 12L. The severity of this vulnerability is classified as High.
How To Fix
Minimum fixed version
10:2022-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The INSTALL_DONT_KILL_APP vulnerability in Android Frameworks Base poses a significant risk to affected devices, allowing for local privilege escalation. It is essential to apply the provided patch and keep the device up to date with the latest security updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows a local attacker to escalate privileges on an affected Android device, potentially leading to unauthorized access to sensitive data or the ability to perform malicious actions.
If your Android version is not listed as affected, you are not vulnerable to this specific issue. However, it is always recommended to keep your device up to date with the latest security patches.
No, user interaction is not needed for exploitation. An attacker with local access to the device can exploit this vulnerability without any user involvement.
No, this vulnerability requires local access to the device. It cannot be exploited remotely over a network.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is crucial to apply the necessary security updates to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
