CVE-2022-44436: Medium severity Google Android vulnerability
Published Jan 1, 2023
·Updated
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Other sources
Messaging do not check the permission , which may cause a Elevation of privilege.
— OSV
Affected Software
34 affected componentsFixes available
All of the following
Any of the following
Google Android=10.0
Google Android=11.0
Google Android=12.0
Any of the following
UNISOC S8000
UNISOC Sc7731e
UNISOC Sc9832e
UNISOC Sc9863a
UNISOC T310
UNISOC T606
UNISOC T610
UNISOC T612
UNISOC T616
UNISOC T618
UNISOC T760
UNISOC T770
UNISOC T820
Google Android=10.0
Google Android=11.0
Google Android=12.0
UNISOC S8000
UNISOC Sc7731e
UNISOC Sc9832e
UNISOC Sc9863a
UNISOC T310
UNISOC T606
UNISOC T610
UNISOC T612
UNISOC T616
UNISOC T618
UNISOC T760
UNISOC T770
UNISOC T820
Google Android
android/:unknown:>=SoCVersion:0<SoCVersion:2023-01-05
SoCVersion:2023-01-05
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2023-01-05
Event History
Jan 1, 2023
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Jan 3, 2023
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Jan 4, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs local access and low-level privileges on the affected device. No user interaction or additional execution privileges are required.
2
What is the impact of successful exploitation?
Successful exploitation can cause a local denial of service affecting the contacts service. The provided CVSS vector indicates no confidentiality or integrity impact.