CVE-2022-20007: Race Condition when Start Activities can Cause Not-Paused Background Activity in platform/frameworks/base
Summary
CVE-2022-20007: In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. Affects platform/frameworks/base across 4 version ranges.
>= 10:0, < 10:2022-05-01
>= 11:0, < 11:2022-05-01
>= 12:0, < 12:2022-05-01
>= 12L:0, < 12L:2022-05-01
Fixed in 10:2022-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android operating system. It provides core functionalities and services that are essential for the proper functioning of the system. This package includes various classes and modules that handle activities, windows, and user interface elements. It is responsible for managing the lifecycle of applications, handling user interactions, and ensuring the smooth execution of processes. However, a vulnerability has been identified in the package that can lead to a race condition and allow an overlay app to appear as if it is still in the foreground, even when it is not.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20007, exists in the startActivityForAttachedApplicationIfNeeded method of the RootWindowContainer.java file. Due to a race condition, an app can be overlaid on top of another app, making it believe that it is still in the foreground when it is actually running in the background. This can lead to a local escalation of privilege, as the overlay app can potentially perform actions on behalf of the user without their knowledge or consent. Exploitation of this vulnerability requires user interaction.
How To Fix
Minimum fixed version
10:2022-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the platform/frameworks/base package to a patched version.
Conclusion
The vulnerability identified as CVE-2022-20007 in the platform/frameworks/base package can lead to a race condition that allows an overlay app to appear as if it is still in the foreground. This can result in a local escalation of privilege, with the potential for unauthorized actions to be performed on behalf of the user. It is crucial to update the Android operating system to a patched version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability can allow an overlay app to appear as if it is still in the foreground, potentially performing actions on behalf of the user without their knowledge or consent. It can lead to a local escalation of privilege.
Yes, user interaction is needed for exploitation of this vulnerability.
Versions 10, 11, 12, and 12L of the Android operating system are affected by this vulnerability.
There are no known instances of this vulnerability being exploited at the moment.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using only the gradle.lockfile without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
