CVE-2022-20413: Phone call recording vulnerability in platform/frameworks/av
Summary
CVE-2022-20413: In start of Threads.cpp, there is a possible way to record audio during a phone call due to a logic error in the code. Affects platform/frameworks/av across 5 version ranges.
>= 10:0, < 10:2022-10-01
>= 11:0, < 11:2022-10-01
>= 12:0, < 12:2022-10-01
>= 12L:0, < 12L:2022-10-01
>= 13:0, < 13:2022-10-01
Fixed in 10:2022-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/av package is a part of the Android ecosystem and is responsible for handling audio and video functionality. It provides APIs and services for recording and playing audio, as well as managing phone calls. This package is crucial for the proper functioning of audio-related features on Android devices.
Vulnerability Detail
A logic error in the code of the Threads.cpp file within the platform/frameworks/av package allows for the recording of audio during a phone call. This vulnerability can be exploited if MMAP recording is started after the call has already begun. The vulnerability can lead to local information disclosure, with the attacker requiring user execution privileges. It is important to note that user interaction is not necessary for the exploitation of this vulnerability.
How To Fix
Minimum fixed version
10:2022-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the platform/frameworks/av package allows for the recording of audio during a phone call, potentially leading to the disclosure of sensitive information. It is crucial to update to the fixed version of the package as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/av →
FAQ
This vulnerability allows for the recording of audio during a phone call, potentially leading to the disclosure of sensitive information.
The attacker requires user execution privileges to exploit this vulnerability.
No, user interaction is not needed for the exploitation of this vulnerability.
Versions 10, 11, 12, 12L, and 13 of the Android ecosystem are affected by this vulnerability.
You can find more information about this vulnerability in the Android Open Source Vulnerability database: https://storage.googleapis.com/android-osv/ASB-A-235850634.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
