CVE-2022-20478: Vulnerability in platform/frameworks/base - Failure to Persist Permissions Settings
Summary
CVE-2022-20478: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/frameworks/base is a part of the Android ecosystem and is responsible for providing core functionalities and services to the Android operating system. It includes various components and APIs that enable the functioning of the Android framework. This package is vulnerable to a failure in persisting permissions settings, which can lead to local escalation of privilege without requiring additional execution privileges. This vulnerability affects Android versions 10 and above.
Vulnerability Detail
The vulnerability arises from a flaw in the NotificationChannel class of the NotificationChannel.java file. Due to resource exhaustion, permissions settings fail to persist properly, allowing an attacker to exploit this issue for local privilege escalation. The exploitation does not require any user interaction. The impact of this vulnerability can be severe, as it enables an attacker to gain elevated privileges on the affected device.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the provided patches to fix the issue.
Conclusion
The vulnerability in platform/frameworks/base allows for local escalation of privilege on Android devices. It is crucial to apply the provided patches to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is local escalation of privilege, allowing an attacker to gain elevated privileges on the affected device.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability affects Android versions 10 and above.
There are no known instances of this vulnerability being exploited at the moment.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
