CVE-2022-20338: Input Validation

Published Aug 11, 2022

Updated

In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local escalation of privilege, preventing processes from validating URIs correctly, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-171966843

Affected Software

2 affected components

Google Android=13.0

Google Android

Event History

Aug 11, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Aug 12, 2022

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-20338?

CVE-2022-20338 has been assessed to have a moderate severity rating due to the potential for local escalation of privilege.

How do I fix CVE-2022-20338?

To mitigate CVE-2022-20338, ensure that your Android device is updated to the latest security patch that addresses this vulnerability.

What is the impact of CVE-2022-20338?

CVE-2022-20338 could allow an attacker to craft a malformed Uri object, leading to improper URI validation and potential local privilege escalation.

Is CVE-2022-20338 exploitable remotely?

No, CVE-2022-20338 requires local user interaction to exploit, making it less likely to be exploited remotely.

Which versions of Android are affected by CVE-2022-20338?

CVE-2022-20338 specifically affects Android version 13.0.