CVE-2022-20145: Critical severity Google Android vulnerability
In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 12L-next:2022-06-01 - Upgrade
Upgrade
android/platform/packages/modules/Connectivityto a version that resolves this vulnerability.Fixed in 12L-next:2022-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 11:2022-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20145?
CVE-2022-20145 is classified as a high severity vulnerability due to the potential for remote escalation of privilege.
How do I fix CVE-2022-20145?
To fix CVE-2022-20145, users should update their Android device to a patched version beyond Android 11.0.
What type of attack does CVE-2022-20145 expose users to?
CVE-2022-20145 exposes users to a protocol downgrade attack that can retrieve VPN credentials.
Is user interaction required for exploitation of CVE-2022-20145?
No, user interaction is not needed for the exploitation of CVE-2022-20145.
Which products are affected by CVE-2022-20145?
CVE-2022-20145 affects Google Android version 11.0.