CVE-2022-20456: AutomaticZenRule Notification Access Bypass in Android Frameworks Base
Summary
CVE-2022-20456: In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2023-01-01
>= 11:0, < 11:2023-01-01
>= 12:0, < 12:2023-01-01
>= 12L:0, < 12L:2023-01-01
>= 13:0, < 13:2023-01-01
Fixed in 10:2023-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a fundamental component of the Android operating system that provides essential functionalities and services to other applications. It includes various classes and APIs for managing device settings, user interactions, and system behavior. One of the features provided by this package is the AutomaticZenRule, which allows users to customize notification settings based on specific conditions or rules.
Vulnerability Detail
The vulnerability (CVE-2022-20456) in the AutomaticZenRule of the Android Frameworks Base package allows for the automatic re-enabling of notification access without the user's awareness or consent. This can occur when the user turns off notification access, but the AutomaticZenRule's name is not properly persisted, leading to a resource exhaustion issue. An attacker can exploit this vulnerability to escalate their privileges locally without requiring additional execution privileges. Notably, this vulnerability does not require any user interaction for exploitation.
How To Fix
Minimum fixed version
10:2023-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can consider implementing additional checks and validations in their applications to verify the status of notification access and prompt the user to re-enable it if necessary.
Conclusion
The vulnerability (CVE-2022-20456) in the AutomaticZenRule of the Android Frameworks Base package allows for the automatic re-enabling of notification access without the user's awareness. This can lead to unauthorized access to sensitive information and actions performed through notifications. Developers should update their applications to the latest version of the Android Frameworks Base package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows for the automatic re-enabling of notification access without the user's awareness, potentially leading to unauthorized access to sensitive information and actions performed through notifications.
The vulnerability affects Android versions 10 and onwards.
No, user interaction is not required for exploitation of this vulnerability.
Yes, the Android Frameworks Base package has released a fix for this vulnerability in version 10 and onwards.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
