CVE-2022-20425: Bypass fix of CVE-2022-20143 in platform/frameworks/base
Summary
CVE-2022-20425: In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent degradation of performance due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-10-01
>= 11:0, < 11:2022-10-01
>= 12:0, < 12:2022-10-01
>= 12L:0, < 12L:2022-10-01
>= 13:0, < 13:2022-10-01
Fixed in 10:2022-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/frameworks/base' is a part of the Android ecosystem and provides fundamental functionality and libraries for the Android operating system. It includes various components and APIs that are essential for the proper functioning of Android devices. This package is responsible for managing the Zen Mode feature, which allows users to customize notification settings and prioritize certain activities. ZenModeHelper.java is a key file within this package that handles the creation and management of automatic Zen rules.
Vulnerability Detail
The vulnerability (CVE-2022-20425) is a bypass of the fix for CVE-2022-20143 in ZenModeHelper.java. It allows an attacker with user execution privileges to bypass the limit imposed by Zen rules with a different configuration activity. By exploiting this vulnerability, an attacker can cause a permanent degradation of performance, leading to a local denial of service. The exploitation does not require user interaction.
How To Fix
Minimum fixed version
10:2022-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability (CVE-2022-20425) in the 'platform/frameworks/base' package allows an attacker to bypass Zen rule limits and cause a local denial of service. It is recommended to apply the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an attacker to bypass Zen rule limits and cause a local denial of service. This can lead to a permanent degradation of performance on the affected device.
An attacker with user execution privileges on the affected device can exploit this vulnerability.
No, user interaction is not needed for the exploitation of this vulnerability.
This vulnerability is classified as 'High' severity.
Yes, Android versions 10, 11, 12, 12L, and 13 are all affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
