CVE-2022-20611: Bypass of device carrier restrictions in platform/frameworks/base
Summary
CVE-2022-20611: In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bypass. Affects platform/frameworks/base across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'platform/frameworks/base' is a fundamental component of the Android operating system. It provides core functionalities and services for the Android framework, including system services, libraries, and APIs. This package is responsible for managing various aspects of the device's behavior, such as package installation and removal. It is a critical component that ensures the proper functioning of the Android system.
Vulnerability Detail
The vulnerability (CVE-2022-20611) exists in the 'platform/frameworks/base' package and specifically in the 'deletePackageVersionedInternal' function of the 'DeletePackageHelper.java' file. It allows for a potential bypass of carrier restrictions due to a permissions bypass. This vulnerability could be exploited to escalate privileges locally without requiring additional execution privileges. Notably, user interaction is not necessary for the exploitation of this vulnerability. The impact of this vulnerability could lead to unauthorized access and control over device functionalities, potentially compromising the security and integrity of the Android system.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the fix mentioned above to address the issue effectively.
Conclusion
The vulnerability (CVE-2022-20611) in the 'platform/frameworks/base' package allows for a bypass of carrier restrictions, potentially leading to local privilege escalation. It is crucial to update the package to the latest version and apply the provided fix to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows for a bypass of carrier restrictions, potentially leading to local privilege escalation and unauthorized access/control over device functionalities.
No, user interaction is not needed for the exploitation of this vulnerability.
The vulnerability affects Android versions 10, 11, 12, 12L, and 13.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the gradle.lockfile, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
