PT-2022-25106 · Google · Android

Yousra Aafer · Published 2022-12-08 · Updated 2022-12-12 · CVE-2022-39912

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to T(13)

Description The issue is related to improper handling of insufficient permissions in the setSecureFolderPolicy function within the PersonaManagerService. This allows local attackers to set certain setting values in the Secure folder.

Recommendations For Android versions prior to T(13), update to Android T(13) or later to resolve the issue.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-280

Related Identifiers

CVE-2022-39912

Affected Products

Android

References · 4

• https://osv.dev/vulnerability/CVE-2022-39912 · Vendor Advisory
• https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39912 · Security Note
• https://t.me/cvenotify/39438 · Telegram Post