CVE-2022-2985: High severity Google Android vulnerability
Published Oct 14, 2022
·Updated
In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Affected Software
32 affected componentsFixes available
Google Android=10.0
Google Android=11.0
UNISOC S8000
UNISOC Sc7731e
UNISOC Sc9832e
UNISOC Sc9863a
UNISOC T310
UNISOC T606
UNISOC T610
UNISOC T612
UNISOC T616
UNISOC T618
UNISOC T760
UNISOC T770
UNISOC T820
All of the following
Any of the following
Google Android=10.0
Google Android=11.0
Any of the following
UNISOC S8000
UNISOC Sc7731e
UNISOC Sc9832e
UNISOC Sc9863a
UNISOC T310
UNISOC T606
UNISOC T610
UNISOC T612
UNISOC T616
UNISOC T618
UNISOC T760
UNISOC T770
UNISOC T820
Google Android
android/:unknown:>=SoCVersion:0<SoCVersion:2022-11-05
SoCVersion:2022-11-05
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2022-11-05
Event History
Oct 14, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Nov 1, 2022
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Nov 7, 2022
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-2985?
CVE-2022-2985 has a severity rating of moderate due to the risk of privilege escalation.
2
How do I fix CVE-2022-2985?
To fix CVE-2022-2985, update your affected Android device to the latest version provided by the manufacturer.
3
What systems are affected by CVE-2022-2985?
CVE-2022-2985 affects Android versions 10.0 and 11.0.
4
Can CVE-2022-2985 be exploited remotely?
CVE-2022-2985 requires local access to the affected device to exploit the vulnerability.
5
What consequences can result from CVE-2022-2985?
Exploitation of CVE-2022-2985 can lead to unauthorized access to contacts and other personal information.