CVE-2022-20128: adb Directory Traversal Vulnerability in Android ADB Package
Summary
CVE-2022-20128: In finishLsImpl of file_sync_client.cpp, there is a possible way to access host's files due to a path traversal error. Affects platform/packages/modules/adb across 3 version ranges.
>= 12:0, < 12:2022-06-01
>= 12L:0, < 12L:2022-06-01
>= 12L-next:0, < 12L-next:2022-06-01
Fixed in 12L-next:2022-06-01. How to fix ↓
Also tracked for
- android-platform-system-core · Debian:11
The same CVE-2022-20128 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Debug Bridge (ADB) is a versatile command-line tool that allows developers to communicate with an Android device. It facilitates various operations such as installing and debugging applications, accessing device logs, and executing shell commands. The ADB package is crucial for developers working with Android, but it is also susceptible to vulnerabilities that can compromise the security of the host system. This specific vulnerability arises from a path traversal error in the file_sync_client.cpp file, which can lead to unauthorized access to the host's file system.
Vulnerability Detail
In the finishLsImpl function of file_sync_client.cpp, a path traversal vulnerability exists that allows a malicious adbd device process to write to arbitrary locations on the host system. This flaw can lead to local escalation of privilege without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous as it can be exploited silently by an attacker.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the ADB daemon or disable ADB altogether until the patch is applied. This can be done by navigating to the Developer Options on the Android device and toggling off the 'USB debugging' option.
Conclusion
CVE-2022-20128 is a significant vulnerability in the Android ADB package that allows for unauthorized file access on the host system. It is crucial for developers and users to apply the necessary updates to mitigate the risk associated with this vulnerability. Regular monitoring and prompt updates are essential to maintain the security of Android applications.
See every vulnerability recorded for platform/packages/modules/adb →
FAQ
The impact includes potential unauthorized access to the host file system, leading to local privilege escalation.
No, exploitation does not require user interaction, making it more dangerous.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
As a temporary workaround, restrict access to ADB or disable it until the update can be applied.
Detailed information can be found in the Android Open Source Vulnerability database and the provided links to the patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/adb.
