PT-2022-14442 · Google · Android

Published 2022-07-01 · Updated 2023-08-08 · CVE-2022-20219

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-12L

Description A logic error in the code of StorageManagerService.java and UserManagerService.java can lead to user directories being left unencrypted. This issue can result in local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations For Android versions Android-10 through Android-12L, update to a version that includes the fix for the logic error in StorageManagerService.java and UserManagerService.java to prevent user directories from being left unencrypted.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

ASB-A-224585613

CVE-2022-20219

Affected Products

Android

References · 10

• https://source.android.com/security/bulletin/2022-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-224585613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20219 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/187187a31441e44c29d13c1a04c932abc420b709 · Note
• https://android.googlesource.com/platform/frameworks/base/+/2ba316f58e4429033caa495cbc22a0d66dd92d15 · Note
• https://android.googlesource.com/platform/frameworks/base/+/6ba336c0e280183a04ca45b217a7e89f8419d62b · Note
• https://android.googlesource.com/platform/frameworks/base/+/16cf824d3a3dab638698ffaa995621ae18cfcf4e · Note
• https://android.googlesource.com/platform/frameworks/base/+/0067ba2426506ec7516dcb18bec5f8a68c116fe9 · Note
• https://t.me/cibsecurity/46199 · Telegram Post