CVE-2022-20490: AutomaticZenRule Privilege Escalation in Android Frameworks Base
Summary
CVE-2022-20490: In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2023-01-01
>= 11:0, < 11:2023-01-01
>= 12:0, < 12:2023-01-01
>= 12L:0, < 12L:2023-01-01
>= 13:0, < 13:2023-01-01
Fixed in 10:2023-01-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a fundamental component of the Android operating system that provides core functionalities and APIs for app development. It includes various modules and libraries that enable the execution of essential system processes and services. One of these modules is AutomaticZenRule, which allows apps to define rules for automatic notification management. This vulnerability affects versions 10 to 13 of the Android Frameworks Base package.
Vulnerability Detail
The vulnerability (CVE-2022-20490) resides in the AutomaticZenRule.java file within the Android Frameworks Base package. It stems from a failure to persist permission settings, which can be exploited to achieve local privilege escalation. An attacker can leverage this vulnerability to gain elevated privileges without requiring additional execution privileges or user interaction. The issue arises due to resource exhaustion, potentially leading to unauthorized access and control over sensitive system functionalities.
How To Fix
Minimum fixed version
10:2023-01-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the official patch to ensure the security and integrity of the Android Frameworks Base package.
Conclusion
The vulnerability (CVE-2022-20490) in the Android Frameworks Base package poses a significant risk of privilege escalation. It is crucial for developers to promptly apply the provided patch to mitigate the vulnerability and ensure the security of their applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The Android Frameworks Base package is a core component of the Android operating system that provides essential functionalities and APIs for app development.
AutomaticZenRule is a module within the Android Frameworks Base package that allows apps to define rules for automatic notification management.
This vulnerability allows an attacker to escalate their privileges locally, potentially gaining unauthorized access and control over sensitive system functionalities.
No, only versions 10 to 13 of the Android Frameworks Base package are affected by this vulnerability.
Yes, a fix has been provided by the Android Open Source Project (AOSP). It is recommended to update to a version of the Android Frameworks Base package that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
