PT-2023-12647 · Google · Android

Published 2023-01-24 · Updated 2023-02-01 · CVE-2022-20458

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to Android-12L

Description The issue concerns the logging of sensitive information, such as personally identifiable information (PII) or hardware identifiers, in Android builds. Specifically, the StatusBarNotification.getKey() function could contain sensitive information. However, in the CarNotificationListener.java file, this sensitive information is printed directly to logs in Android "user" builds, potentially exposing users' account names. This behavior is not in line with the expected practice of only printing such sensitive information in "userdebug" or "eng" builds.

Recommendations For Android versions prior to Android-12L, consider restricting or disabling the logging functionality in CarNotificationListener.java to prevent the exposure of sensitive information. As a temporary workaround, avoid using the StatusBarNotification.getKey() function in logs until a proper fix is implemented.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-20458

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/aaos/2023-01-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20458 · Security Note
• https://t.me/cibsecurity/56949 · Telegram Post