CVE-2022-20219: Medium severity Google Android vulnerability
In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224585613
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices running Android 10, Android 11, Android 12, or Android 12L are identified as affected. Exploitation is local and requires an attacker to already have low-privileged access on the device; no user interaction is required.
What does an attacker need to exploit it, and what is the impact?
The CVSS vector specifies local access and low privileges required (AV:L/PR:L). The issue can disclose information without requiring additional execution privileges, and it does not affect integrity or availability according to the supplied CVSS vector.
Is there a documented workaround or way to determine whether a device is already affected?
The provided information identifies a logic error that can leave user directories unencrypted, but it does not provide configuration-specific exposure details, detection steps, or an interim mitigation. Refer to the listed Android security bulletin and associated source changes for remediation guidance.