CVE-2022-20349: Bluetooth scanning bypasses admin restrictions in Android Settings and Bluetooth modules
Summary
CVE-2022-20349: In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing permission check. Affects platform/packages/apps/Settings across 4 version ranges.
>= 10:0, < 10:2022-08-01
>= 11:0, < 11:2022-08-01
>= 12:0, < 12:2022-08-01
>= 12L:0, < 12L:2022-08-01
Fixed in 10:2022-08-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android platform includes the Settings app and Bluetooth modules that provide users with control over various device settings, including Wi-Fi and Bluetooth. The Settings app allows users to manage their device preferences, while the Bluetooth modules enable Bluetooth functionality. These components are integral to the Android ecosystem and are present in multiple Android versions.
Vulnerability Detail
The vulnerability identified as CVE-2022-20349 affects the Bluetooth scanning feature in the Android Settings app and Bluetooth modules. The issue arises due to a missing permission check in the WifiScanningPreferenceController and BluetoothScanningPreferenceController classes. This flaw allows an attacker to bypass admin restrictions imposed by UserManager.DISALLOW_BLUETOOTH/DISALLOW_CONFIG_BLUETOOTH. By exploiting this vulnerability, an attacker can escalate their privileges locally without requiring additional execution privileges. Notably, user interaction is not necessary for the successful exploitation of this vulnerability.
How To Fix
Minimum fixed version
10:2022-08-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable Bluetooth scanning manually by navigating to the Bluetooth settings in the Android Settings app and disabling the 'Bluetooth scanning' option. This will prevent potential exploitation of the vulnerability until an official fix is available.
Conclusion
The vulnerability identified as CVE-2022-20349 exposes a flaw in the Bluetooth scanning feature of the Android Settings app and Bluetooth modules. By bypassing admin restrictions, an attacker can escalate their privileges locally without requiring additional execution privileges. This vulnerability affects multiple Android versions, but fixes have been released to address the issue. Developers should update the affected packages and include the necessary permission checks to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
The vulnerability allows an attacker to bypass admin restrictions and escalate their privileges locally. However, it does not grant the attacker any additional execution privileges. Exploitation of this vulnerability can lead to unauthorized access to Bluetooth functionality on the affected device.
No, user interaction is not necessary for the successful exploitation of this vulnerability. An attacker can exploit the vulnerability without any user involvement.
The vulnerability affects Android versions 10, 11, 12, and 12L.
Yes, fixes for this vulnerability have been released. Developers should update the affected packages, including the Android Settings app and Bluetooth modules, to include the necessary permission checks and release updated versions.
For more information about this vulnerability, you can refer to the official Android Open Source Project (AOSP) security bulletin: [link to the bulletin].
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
