CVE-2022-20491: NotificationChannel Resource Exhaustion Vulnerability in Android Frameworks Base
Summary
CVE-2022-20491: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system that provides essential functionality and services for the platform. It includes various APIs and libraries that enable the development of Android applications. The NotificationChannel class within this package is responsible for managing notification channels, which allow users to customize the behavior and appearance of notifications from different apps. This vulnerability affects versions 10 and above of the Android operating system.
Vulnerability Detail
The NotificationChannel resource exhaustion vulnerability in Android Frameworks Base arises from a failure to persist permissions settings due to resource exhaustion. This vulnerability can be exploited to escalate privileges locally without requiring additional execution privileges. The issue occurs when the user turns off notification access, and the system automatically turns it back on without the user's awareness. This can lead to unauthorized access to sensitive information and potential misuse of notification features.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to apply the recommended fix by updating the Android Frameworks Base package.
Conclusion
The NotificationChannel resource exhaustion vulnerability in Android Frameworks Base can lead to local privilege escalation and unauthorized access to sensitive information. It is crucial to update the Android operating system to the latest version that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to escalate privileges locally, potentially gaining unauthorized access to sensitive information and exploiting notification features.
Versions 10 and above of the Android operating system are affected by this vulnerability.
No, user interaction is not needed for exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
