CVE-2022-20500: Permanent denial of service via ShortcutManager#addDynamicShortcuts with invalid Intent.mFlags in platform/frameworks/base
Summary
CVE-2022-20500: In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android operating system. It provides core functionalities and APIs for various system services and applications. One of its features is the ShortcutManager, which allows apps to create and manage shortcuts for quick access to specific actions or content. However, a vulnerability has been discovered in the addDynamicShortcuts method of the ShortcutManager, which can lead to a permanent denial of service.
Vulnerability Detail
The vulnerability arises in the loadFromXml function of the ShortcutPackage class. When processing a shortcut XML file, an uncaught exception can occur, resulting in a crash on boot. This vulnerability can be exploited locally without requiring additional execution privileges or user interaction. The impact is limited to a denial of service, causing the affected device to become unresponsive or unstable.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that their applications do not use the addDynamicShortcuts method with invalid Intent.mFlags.
Conclusion
The vulnerability CVE-2022-20500 in the platform/frameworks/base package of the Android operating system can lead to a permanent denial of service. It is crucial for developers to update their applications to the fixed version of the package to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is a permanent denial of service, which can make the affected device unresponsive or unstable.
No, this vulnerability can be exploited locally without requiring any user interaction.
No, the vulnerability was introduced in version 10 of the Android operating system and fixed in versions 10, 11, 12, 12L, and 13.
There is no known exploit for this vulnerability at the moment.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
