CVE-2022-20426: Incomplete fix of resource exhaustion vulnerability in platform/frameworks/base and platform/packages/services/Telecomm
Summary
CVE-2022-20426: In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-11-01
>= 11:0, < 11:2022-11-01
>= 12:0, < 12:2022-11-01
>= 12L:0, < 12L:2022-11-01
>= 13:0, < 13:2022-11-01
Fixed in 10:2022-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android operating system that provides core functionalities and services. It includes various modules and libraries that handle essential system operations. The platform/packages/services/Telecomm package, on the other hand, is responsible for managing telecommunication services on Android devices, such as handling phone calls and managing phone accounts.
Vulnerability Detail
The vulnerability (CVE-2022-20426) exists in multiple functions of the platform/frameworks/base and platform/packages/services/Telecomm packages. It is an incomplete fix of a previously identified vulnerability (CVE-2022-20129). The issue arises from the improper handling of phone account selection, which can lead to resource exhaustion and result in a local denial of service attack. Exploitation of this vulnerability does not require any additional execution privileges or user interaction.
How To Fix
Minimum fixed version
10:2022-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability (CVE-2022-20426) in platform/frameworks/base and platform/packages/services/Telecomm can lead to resource exhaustion and local denial of service attacks. It is crucial to apply the provided patches to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability can lead to local denial of service attacks, causing resource exhaustion and hindering the user's ability to select a phone account.
No, exploitation of this vulnerability does not require any additional execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects Android versions 10, 11, 12, 12L, and 13.
Applying the provided patches for the affected packages is the recommended mitigation for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
