CVE-2022-20485
First published: Mon Dec 05 2022(Updated: )
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242702935
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Android | =10.0 | |
| Android | =11.0 | |
| Android | =12.0 | |
| Android | =12.1 | |
| Android | =13.0 | |
| Android | ||
| =10.0 | ||
| =11.0 | ||
| =12.0 | ||
| =12.1 | ||
| =13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://source.android.com/security/bulletin/2022-12-01
- https://android.googlesource.com/platform/frameworks/base/+/3850857cb0e7f26702d5bd601731d7290390fa3b
- https://android.googlesource.com/platform/frameworks/base/+/6f02c07176d0fa4d6985c8f2200ccf49a1657d1c
- https://source.android.com/docs/security/bulletin/2022-12-01 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-20485?
CVE-2022-20485 has a severity rating that indicates moderate risk for local escalation of privilege.
How does CVE-2022-20485 exploit work?
CVE-2022-20485 exploits a failure to persist permission settings due to resource exhaustion without needing user interaction.
Which versions of Android are affected by CVE-2022-20485?
CVE-2022-20485 affects Android versions 10.0, 11.0, 12.0, 12.1, and 13.0.
Is user interaction required to exploit CVE-2022-20485?
No, user interaction is not required to exploit CVE-2022-20485.
How can I mitigate the risks associated with CVE-2022-20485?
To mitigate risks associated with CVE-2022-20485, ensure that your Android device is updated to the latest security patch.
- agent/type
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/google
- canonical/android
- version/android/10.0
- version/android/11.0
- version/android/12.0
- version/android/12.1
- version/android/13.0