CVE-2022-20489: AutomaticZenRule Configuration Activity Notification Access Vulnerability in platform/frameworks/base
Summary
CVE-2022-20489: In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2023-01-01
>= 11:0, < 11:2023-01-01
>= 12:0, < 12:2023-01-01
>= 12L:0, < 12L:2023-01-01
>= 13:0, < 13:2023-01-01
Fixed in 10:2023-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android operating system. It provides core functionalities and services for various system operations. One of its features is the AutomaticZenRule, which allows users to configure notification settings for different scenarios. However, a vulnerability has been identified in the configuration activity of AutomaticZenRule, which can lead to the automatic enabling of notification access without the user's awareness.
Vulnerability Detail
The vulnerability arises from a failure to persist permissions settings in AutomaticZenRule.java, potentially due to resource exhaustion. This can result in a local escalation of privilege, allowing an attacker to gain elevated privileges without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction. The impact of this vulnerability can range from unauthorized access to sensitive notifications to potential abuse of notification access for malicious purposes.
How To Fix
Minimum fixed version
10:2023-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The AutomaticZenRule Configuration Activity Notification Access Vulnerability in platform/frameworks/base poses a significant security risk, allowing for unauthorized access to notifications and potential abuse of notification access. It is crucial to apply the provided fix from the Android Open Source Project to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The package affected by this vulnerability is platform/frameworks/base in the Android ecosystem.
The vulnerability was introduced in Android 10 and affects subsequent versions up to Android 13.
The severity of this vulnerability is classified as High.
No, user interaction is not needed for exploitation of this vulnerability.
The fix for this vulnerability was introduced on January 1, 2023, for Android versions 10, 11, 12, 12L, and 13.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
