CVE-2022-20480: NotificationChannelGroup mName Privilege Escalation in Android
Summary
CVE-2022-20480: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android platform includes the framework package 'platform/frameworks/base', which provides essential functionalities and services for Android devices. One of the components in this package is the NotificationChannelGroup class, which is responsible for managing groups of notification channels. Notification channels are used to categorize and control the behavior of notifications on Android devices. This vulnerability affects Android versions 10 and above.
Vulnerability Detail
The vulnerability (CVE-2022-20480) lies in the implementation of the NotificationChannelGroup class in the 'platform/frameworks/base' package. Specifically, there is a flaw in the handling of notification access permissions. When the user turns off notification access, the mName field of the NotificationChannelGroup is automatically turned on without the user's awareness. This behavior can be exploited by an attacker to gain local escalation of privilege without requiring any additional execution privileges. Notably, user interaction is not necessary for the exploitation of this vulnerability.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the provided patches as soon as possible to address the issue.
Conclusion
The vulnerability (CVE-2022-20480) in the NotificationChannelGroup class of the 'platform/frameworks/base' package in Android can lead to local escalation of privilege. It is crucial to update the affected Android devices with the provided patches to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to gain local escalation of privilege on Android devices. By exploiting the flaw in the NotificationChannelGroup class, an attacker can bypass notification access permissions and potentially perform unauthorized actions.
This vulnerability affects Android versions 10 and above.
No, user interaction is not needed for the exploitation of this vulnerability.
The recommended mitigation is to apply the provided patches for the affected Android versions. Updating the devices with the latest security patches will help mitigate the risk of exploitation.
For more information about this vulnerability, you can refer to the official Android Open Source Project (AOSP) security bulletin or contact the Android security team.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
