PT-2022-14665 · Google · Android

Published 2022-11-01 · Updated 2025-05-01 · CVE-2022-20441

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions Android-10 through Android-13

Description A logic error in the code of Task.java allows for the launch of an unexported intent handler, potentially leading to local escalation of privilege. This issue can be exploited without additional execution privileges if the targeted app has an intent trampoline. User interaction is not required for exploitation.

Recommendations For Android versions Android-10 through Android-13, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ASB-A-238605611

CVE-2022-20441

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/2022-11-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20441 · Security Note
• https://osv.dev/vulnerability/ASB-A-238605611 · Vendor Advisory
• https://t.me/cvenotify/120520 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/54e57bbbd679cd7dd25c394d98ae399c8312a867 · Note