CVE-2022-20347: High severity android vulnerability
In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228450811
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20347?
The severity of CVE-2022-20347 is classified as high due to the potential for remote privilege escalation in Bluetooth settings.
How do I fix CVE-2022-20347?
To fix CVE-2022-20347, update your Android device to the latest software version provided by the manufacturer.
Which Android versions are affected by CVE-2022-20347?
CVE-2022-20347 affects Android versions 10.0, 11.0, 12.0, and 12.1.
Is user interaction required to exploit CVE-2022-20347?
No, user interaction is not needed for exploitation of CVE-2022-20347.
What does a confused deputy mean in the context of CVE-2022-20347?
In CVE-2022-20347, a confused deputy refers to a situation where a component is misled into granting permissions it should not, leading to unauthorized access.