CVE-2022-20457: Installer apps unable to install apps using obb files in platform/frameworks/base
Summary
CVE-2022-20457: In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. Affects platform/frameworks/base versions >= 13:0, < 13:2022-11-01. Fixed in 13:2022-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/frameworks/base is a fundamental component of the Android ecosystem. It provides core functionalities and services for the Android operating system. This package is responsible for managing storage, including the installation and management of applications. It is a critical component that ensures the proper functioning of the Android platform.
Vulnerability Detail
The vulnerability identified as CVE-2022-20457 affects the package platform/frameworks/base. Specifically, it impacts the installer apps targeting SDK 33, preventing them from installing applications that use obb files. The vulnerability arises from improper input validation in the getMountModeInternal function of StorageManagerService.java. Exploiting this vulnerability could lead to a local escalation of privilege without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
13:2022-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability identified as CVE-2022-20457 affects the package platform/frameworks/base, specifically impacting installer apps targeting SDK 33. It prevents the installation of applications that use obb files. Developers should apply the provided fix from the Android Open Source Project to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability prevents installer apps targeting SDK 33 from installing applications that use obb files. This limitation can disrupt the installation process and hinder the functionality of affected applications.
No, user interaction is not needed for exploiting this vulnerability.
The severity of this vulnerability is classified as High.
There are no known instances of this vulnerability being exploited at the time of this report.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the gradle.lockfile, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
