CVE-2022-20223: EoP in AppRestrictionsFragment of platform/packages/apps/Settings
Summary
CVE-2022-20223: In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. Affects platform/packages/apps/Settings across 4 version ranges.
>= 10:0, < 10:2022-07-01
>= 11:0, < 11:2022-07-01
>= 12:0, < 12:2022-07-01
>= 12L:0, < 12L:2022-07-01
Fixed in 10:2022-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/apps/Settings, which is a part of the Android ecosystem. It is responsible for managing various settings and preferences on Android devices. The AppRestrictionsFragment is a component within this package that deals with app restrictions and permissions. It provides a user interface for managing app-specific restrictions and permissions. Unfortunately, a vulnerability has been identified in this fragment that allows for local escalation of privilege.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20223, originates from an unsafe package check in the assertSafeToStartCustomActivity function of AppRestrictionsFragment.java. This check can be bypassed, leading to the ability to start a phone call without the necessary permissions. This confusion allows an attacker to escalate their privileges locally without requiring any additional execution privileges. Exploitation of this vulnerability does not require user interaction. The impact of this vulnerability is significant as it allows an attacker to perform unauthorized phone calls, potentially leading to privacy breaches and further compromise of the device.
How To Fix
Minimum fixed version
10:2022-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the AppRestrictionsFragment in platform/packages/apps/Settings is vulnerable to a local escalation of privilege, allowing unauthorized phone calls. It is crucial to apply the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
The impact of this vulnerability is local escalation of privilege, allowing an attacker to start phone calls without the necessary permissions.
No, exploitation of this vulnerability does not require user interaction.
The severity of this vulnerability is classified as High.
Versions 10, 11, 12, and 12L of the Android ecosystem are affected.
Yes, a fix has been provided by the Android Open Source Project. It is recommended to update the affected package to a version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
