PT-2022-14478 · Google · Android

Published 2022-08-11 · Updated 2023-08-08 · CVE-2022-20255

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description The issue concerns a missing permission check in the SettingsProvider, allowing potential reading or modification of the default ringtone. This could result in local escalation of privilege without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation.

Recommendations For Android version Android-13, consider restricting access to the SettingsProvider until a patch is available. As a temporary workaround, review and restrict any unnecessary permissions related to ringtone settings to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20255

Affected Products

Android

References · 3

• https://source.android.com/security/bulletin/android-13 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20255 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20255 · Vendor Advisory