CVE-2022-20466: Insecure Default Value in KeyGaurd and Set Pin/Password Screen in Android
Summary
CVE-2022-20466: In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is responsible for providing the fundamental functionalities and components of the Android operating system. It includes the keyguard and set pin/password screen, which are crucial for securing the user's device. However, a vulnerability has been identified in the implementation of FLAG_SECURE in these screens, which could lead to local information disclosure.
Vulnerability Detail
The vulnerability (CVE-2022-20466) arises from the insecure default value in the applyKeyguardFlags function of NotificationShadeWindowControllerImpl.java. This function is responsible for setting the keyguard flags, including FLAG_SECURE, which prevents sensitive information from being displayed on secondary displays. However, due to an insecure default value, the FLAG_SECURE is not included in the keyguard and set pin/password screen. This means that an attacker with physical access to the secondary display could observe the user's password, leading to local information disclosure. Exploitation of this vulnerability requires user interaction.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2022-20466) in the Android package platform/frameworks/base exposes the user's password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is required for exploitation. Developers should update their applications to the fixed versions provided by the Android team. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an attacker with physical access to the secondary display to observe the user's password, leading to local information disclosure.
The vulnerability affects Android versions 10, 11, 12, 12L, and 13.
Yes, user interaction is needed for exploitation of this vulnerability.
The recommended mitigation is to update the affected packages to the fixed versions provided by the Android team.
More information about this vulnerability can be found in the Android Open Source Project Security Bulletin: https://storage.googleapis.com/android-osv/ASB-A-179725730.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
