CVE-2022-20479: Vulnerability in platform/frameworks/base - Failure to Persist Permissions Settings
Summary
CVE-2022-20479: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base, which is a part of the Android ecosystem. It provides fundamental functionalities and services for the Android operating system. This package is responsible for managing various system components, including notifications. It includes the NotificationChannel class, which allows developers to create and manage notification channels for their apps. These channels define the behavior and characteristics of notifications, such as sound, vibration, and importance level. However, a vulnerability has been identified in the NotificationChannel class that could lead to local escalation of privilege.
Vulnerability Detail
The vulnerability (CVE-2022-20479) originates from a failure to persist permissions settings in the NotificationChannel class of the platform/frameworks/base package. This failure is caused by resource exhaustion, which prevents the proper persistence of permissions settings. As a result, an attacker can exploit this vulnerability to escalate their privileges on the local system without requiring any additional execution privileges. The exploitation does not require user interaction. The impact of this vulnerability can be significant, as it allows an attacker to gain elevated privileges and potentially perform unauthorized actions on the affected Android device.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability (CVE-2022-20479) in the platform/frameworks/base package poses a significant risk to the security of Android devices. It allows an attacker to escalate their privileges without user interaction, potentially leading to unauthorized actions and access to sensitive information. It is crucial to apply the provided patches promptly to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to escalate their privileges on the local system, potentially leading to unauthorized actions and access to sensitive information.
No, user interaction is not needed for the exploitation of this vulnerability.
This vulnerability affects Android versions 10, 11, 12, 12L, and 13.
No, there are no known workarounds for this vulnerability. It is recommended to apply the provided patches.
You can find more information about this vulnerability in the Android Open Source Project's security bulletin (ASB-A-241764340).
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
