CVE-2022-20450: Apps can get the ACTIVITY_RECOGNITION runtime permission silently via app upgrade on Q and above
Summary
CVE-2022-20450: In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. Affects platform/frameworks/base across 4 version ranges.
>= 11:0, < 11:2022-11-01
>= 12:0, < 12:2022-11-01
>= 12L:0, < 12L:2022-11-01
>= 13:0, < 13:2022-11-01
Fixed in 11:2022-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is a fundamental part of the Android operating system, providing core functionalities and services to other components. It includes various frameworks and libraries that enable the development and execution of Android applications. One of the features provided by this package is the runtime permission system, which allows apps to request and obtain permissions from the user at runtime. This system ensures that apps have the necessary permissions to access sensitive resources or perform restricted actions. However, a vulnerability has been identified in the package that allows apps to bypass user consent and obtain the ACTIVITY_RECOGNITION runtime permission silently.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20450, resides in the restorePermissionState function of PermissionManagerServiceImpl.java within the platform/frameworks/base package. This function is responsible for restoring the state of permissions during app upgrades. However, due to a missing permission check, an app can exploit this vulnerability to escalate its privileges without requiring any additional execution privileges or user interaction. By leveraging this vulnerability, an attacker can silently obtain the ACTIVITY_RECOGNITION runtime permission, which grants access to the user's physical activity data. This can lead to privacy breaches and potential misuse of sensitive information. The vulnerability affects Android versions 10 and above, including Android 12 and Android 13.
How To Fix
Minimum fixed version
11:2022-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix provided by the Android Open Source Project.
Conclusion
The vulnerability in the platform/frameworks/base package allows apps to bypass user consent and obtain the ACTIVITY_RECOGNITION runtime permission silently. This can lead to privacy breaches and potential misuse of sensitive user data. It is crucial for developers to apply the provided fix from the Android Open Source Project to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows apps to obtain the ACTIVITY_RECOGNITION runtime permission silently, potentially leading to privacy breaches and misuse of sensitive user data.
The vulnerability affects Android versions 10 and above, including Android 12 and Android 13.
No, user interaction is not needed for exploitation. The vulnerability allows apps to bypass user consent and obtain the permission silently.
No, there are no known workarounds for this vulnerability. It is recommended to apply the official fix provided by the Android Open Source Project.
More information about the fix can be found at the following URL: https://android.googlesource.com/platform/frameworks/base/+/0873a30210d6425ffb28021000ef3fe40a8da711
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
