CVE-2022-20220: Path Traversal in CallLogProvider
Summary
CVE-2022-20220: In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. Affects platform/packages/providers/ContactsProvider across 2 version ranges.
>= 12:0, < 12:2022-07-05
>= 12L:0, < 12L:2022-07-05
Fixed in 12:2022-07-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ContactsProvider package in the Android ecosystem is responsible for managing call logs. It provides functionality for storing, retrieving, and updating call log information on Android devices. The CallLogProvider component is a part of this package and is responsible for handling file operations related to call logs.
Vulnerability Detail
The vulnerability (CVE-2022-20220) is a path traversal error present in the openFile function of the CallLogProvider.java file. This flaw allows an attacker to bypass permissions and potentially escalate privileges locally. Exploitation of this vulnerability does not require user interaction. The impact of successful exploitation could lead to an elevation of privileges, with the attacker gaining execution privileges.
How To Fix
Minimum fixed version
12:2022-07-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the ContactsProvider package.
Conclusion
The path traversal vulnerability in the CallLogProvider component of the ContactsProvider package can lead to local privilege escalation. It is recommended to update the package to version 12 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/providers/ContactsProvider →
FAQ
Successful exploitation of this vulnerability could allow an attacker to escalate privileges locally, potentially gaining execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability was introduced in version 12 of the ContactsProvider package. All versions prior to the fix (12 and earlier) are affected.
Yes, the fix for this vulnerability was implemented in version 12 of the ContactsProvider package, released on July 5, 2022.
You can find more information about this vulnerability in the Android Open Source Vulnerabilities database. The vulnerability details can be accessed using the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/ContactsProvider.
