CVE-2022-20240

What it actually does

Missing permission check in AppOpsManager.java sOpAllowSystemRestrictionBypass method allows a process with system execution privileges to bypass location restriction and leak location data.

Why it matters to the business

Limited risk of unauthorized location data exposure on affected Android devices; requires system-level access so impact is confined to highly privileged local contexts with low prevalence of exploitation.

How an attack unfolds

An attacker already holding system execution privileges invokes the vulnerable AppOpsManager method to bypass the missing permission check and retrieve location information without additional user interaction.

How to fix it

Apply the latest Android security patches for Android 12 and 12L that address A-231496105; no specific fixed versions listed in the advisory.

How to confirm the fix worked

Review AppOpsManager.java for addition of the required permission check around sOpAllowSystemRestrictionBypass; confirm via Android security bulletin that the device has received the corresponding monthly patch.

Typical attack path

1. Obtain system execution privileges on the device
2. Invoke sOpAllowSystemRestrictionBypass in AppOpsManager
3. Bypass location restriction due to absent permission check
4. Exfiltrate leaked location data

How to detect it

Examine system logs for unexpected calls to AppOpsManager location-related methods from non-standard system contexts; review audit logs for location access without corresponding permission grants.

What your security team should do

• Prioritize deployment of current Android security updates across the fleet
• Audit any custom system applications for similar missing permission checks
• Monitor EPSS and KEV status for any change indicating increased risk