CVE-2022-20234: High severity android vulnerability
In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgTitle' from user.An unprivileged app can use a malicous mComponentName with a benign pkgTitle (e.g. Settings app) to make users enable notification access permission for the malicious app. That is, users believe they enable the notification access permission for the Settings app, but actually they enable the notification access permission for the malicious app.Once the malicious app gets the notification access permission, it can read all notifications, including users' personal information.Product: AndroidVersions: Android-12LAndroid ID: A-225189301
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get an unprivileged malicious app onto the device and induce the user to enable notification access. The app can supply a malicious component name while displaying a benign application title, such as the Settings app.
What information could a malicious app access after successful exploitation?
After notification access is enabled, the malicious app can read all notifications, including notifications containing the user's personal information.
Which systems are identified as affected?
The affected product is Android, and the listed affected version is Android 12L. The vulnerable component is the Car Settings app's exported NotificationAccessConfirmationActivity.
Is a fix available?
Yes. A patch is available, and the issue is covered by the Android Automotive OS security bulletin dated 2022-07-01.