PT-2022-14498 · Google · Android

Published 2022-08-11 · Updated 2023-08-08 · CVE-2022-20274

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description In Keyguard, there is a missing permission check. This could lead to local escalation of privilege and prevention of screen timeout with User execution privileges needed. User interaction is not needed for exploitation.

Recommendations For Android version Android-13, consider restricting access to the Keyguard component to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and adjust permission settings to prevent local escalation of privilege.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-20274

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2022-20274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20274 · Security Note
• https://source.android.com/security/bulletin/android-13 · Vendor Advisory
• https://t.me/cibsecurity/48072 · Telegram Post