CVE-2022-20420: Open Source Vulnerability in platform/frameworks/base
Summary
CVE-2022-20420: In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. Affects platform/frameworks/base versions >= 13:0, < 13:2022-10-01. Fixed in 13:2022-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. This package is responsible for managing various system-level tasks, including battery optimization. It includes the FGS Task Manager, which allows users to control background restrictions for different apps.
Vulnerability Detail
The FGS Task Manager in the platform/frameworks/base package has a logic error in the code that allows bypassing device policy restrictions. Specifically, the getBackgroundRestrictionExemptionReason function in AppRestrictionController.java incorrectly displays a Stop button for apps that have been whitelisted to be exempt from battery optimization. This vulnerability can be exploited locally, leading to a local escalation of privilege without requiring additional execution privileges. It is important to note that user interaction is not needed for exploitation.
How To Fix
Minimum fixed version
13:2022-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The platform/frameworks/base package in Android is vulnerable to a logic error that allows bypassing device policy restrictions. This can lead to a local escalation of privilege without requiring additional execution privileges. It is crucial to apply the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to bypass device policy restrictions and escalate privileges locally. It can potentially lead to unauthorized access and control over the affected device.
No, user interaction is not needed for exploitation of this vulnerability.
No, the vulnerability was introduced in version 13:0 and fixed in version 13:2022-10-01 of the package.
There is no known exploit available at the moment.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
