CVE-2022-20399 — Incorrect Permission Assignment in Google Android

CWE-732 — Incorrect Permission Assignment4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 96.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Android
Timeline
PublishedSep 13
Latest updateSep 14

Description

In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219808546References: Upstream kernel

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages1 packages

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9jg9-7mjm-x5wx: In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value↗2022-09-14
▶
OSV
CVE-2022-20399: In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value↗2022-09-01
▶

📋Vendor Advisories

1
Android
CVE-2022-20399: SELinux↗2022-09-01
▶