CVE-2022-20134: Contact CallSubjectDialog USSD Code Execution
Summary
CVE-2022-20134: In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. Affects platform/packages/apps/Dialer across 5 version ranges.
>= 10:0, < 10:2022-06-01
>= 11:0, < 11:2022-06-01
>= 12:0, < 12:2022-06-01
>= 12L:0, < 12L:2022-06-01
>= 12L-next:0, < 12L-next:2022-06-01
Fixed in 12L-next:2022-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Contacts package is an Android application that provides functionality for managing contacts, including creating, editing, and deleting contacts. The Dialer package is another Android application that allows users to make phone calls. Both packages are part of the Android operating system and are present in versions 10, 11, 12, and 12L. These packages are vulnerable to a security issue that can be exploited through the CallSubjectDialog component.
Vulnerability Detail
The vulnerability exists in the readArguments function of the CallSubjectDialog.java file. Due to improper input validation, an attacker can trick the user into calling the wrong phone number by exploiting this vulnerability. This can lead to a local escalation of privilege without requiring additional execution privileges. The exploitation does not require user interaction.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Contact CallSubjectDialog vulnerability in the Contacts and Dialer packages of the Android operating system allows an attacker to trick users into running dangerous USSD codes. This can lead to unauthorized access or other malicious activities. It is recommended to apply the provided fixes to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Dialer →
FAQ
The vulnerability allows an attacker to trick the user into calling the wrong phone number, potentially leading to unauthorized access or other malicious activities.
Versions 10, 11, 12, and 12L of the Android operating system are affected.
No, user interaction is not required for exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild.
Yes, fixes have been provided for the Contacts and Dialer packages. Please refer to the 'how_to_fix' section for more information.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Dialer.
