CVE-2022-20392: Privilege Escalation in platform/frameworks/base
Summary
CVE-2022-20392: In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-09-01
>= 11:0, < 11:2022-09-01
>= 12:0, < 12:2022-09-01
>= 12L:0, < 12L:2022-09-01
>= 13-next:0, < 13-next:2022-09-01
Fixed in 13-next:2022-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/frameworks/base' is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. This package is responsible for managing permissions, handling app installations and upgrades, and enforcing security policies. Unfortunately, a vulnerability has been discovered in this package that allows an attacker to obtain dangerous system permissions silently through duplicate permission declarations.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20392, originates from improper input validation in the 'declareDuplicatePermission' function of 'ParsedPermissionUtils.java'. This flaw enables an attacker to escalate their privileges locally during app installation or upgrade without requiring additional execution privileges or user interaction. By exploiting this vulnerability, an attacker can bypass user consent and gain access to dangerous permissions, potentially leading to unauthorized access, data breaches, or other malicious activities.
How To Fix
Minimum fixed version
13-next:2022-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is recommended to apply the official fixes provided by the Android team.
Conclusion
The vulnerability (CVE-2022-20392) in the 'platform/frameworks/base' package exposes a critical privilege escalation issue in the Android operating system. It allows an attacker to obtain dangerous system permissions silently, bypassing user consent. To mitigate this vulnerability, it is crucial to update the affected package to the latest available version. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to obtain dangerous system permissions silently, bypassing user consent. It can lead to local privilege escalation and potential unauthorized access, data breaches, or other malicious activities.
No, user interaction is not needed for exploitation. The vulnerability can be exploited during app installation or upgrade without requiring additional execution privileges.
The vulnerability affects Android versions 10, 11, 12, and 12L.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your application without requiring access to the code or installation. Simply upload your gradle.lockfile to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
