PT-2022-14251 · Google · Android

Published 2022-05-01 · Updated 2023-10-03 · CVE-2022-20004

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L

Description The issue is related to improper input validation in the checkSlicePermission function of SliceManagerService.java, allowing access to any slice URI. This could lead to local escalation of privilege without needing additional execution privileges. User interaction is not required for exploitation.

Recommendations For Android versions Android-10 through Android-12L, consider restricting access to the checkSlicePermission function of SliceManagerService.java until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ASB-A-179699767

CVE-2022-20004

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/CVE-2022-20004 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-179699767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20004 · Security Note
• https://source.android.com/security/bulletin/2022-05-01 · Vendor Advisory
• https://twitter.com/Bugsmirror/status/1709175726329442634 · Twitter Post
• https://t.me/cibsecurity/42278 · Telegram Post
• https://twitter.com/Bugsmirror/status/1709175729324183772 · Twitter Post
• https://android.googlesource.com/platform/frameworks/base/+/b55656825844f8ac1d776da0b3290a4e9948ba4f · Note