PT-2022-14647 · Google · Android

Published 2022-10-01 · Updated 2022-10-13 · CVE-2022-20420

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-13

Description A logic error in the code of AppRestrictionController.java, specifically in the getBackgroundRestrictionExemptionReason function, allows for a possible bypass of device policy restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

Recommendations For Android version Android-13, consider restricting access to the getBackgroundRestrictionExemptionReason function in AppRestrictionController.java until a patch is available. As a temporary workaround, review and enforce device policy restrictions to minimize the risk of exploitation.

Fix

Related Identifiers

ASB-A-238377411

CVE-2022-20420

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/2022-10-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20420 · Security Note
• https://osv.dev/vulnerability/ASB-A-238377411 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/95e7a3ee33d3665ec46570dd0b1a6db614384570 · Note
• https://t.me/cvenotify/36977 · Telegram Post