CVE-2022-20474

What it actually does

The flaw allows loading of arbitrary code into the System Settings app via a confused deputy in readLazyValue of Parcel.java, enabling local privilege escalation without additional privileges or user interaction.

Why it matters to the business

Attackers can gain elevated access on affected devices, potentially compromising system settings and user data; the low EPSS and lack of KEV listing reduce immediate widespread urgency, though the 1405 days since publication highlight long-term exposure in Android ecosystems.

How an attack unfolds

An attacker with local access crafts a malicious Parcel object that exploits the confused deputy in readLazyValue to inject and execute arbitrary code within the System Settings app, achieving privilege escalation directly on the device.

How to fix it

Upgrade affected Android versions to patched releases; for open-policy-agent/opa (GIT) instances, update to commit 9b5fb9b1d2feca3eb51da6a383ca25175ee58234.

How to confirm the fix worked

Verify device or package versions against fixed releases and test Parcel handling to confirm the confused deputy path is closed.

Typical attack path

1. Obtain local access to the target Android device
2. Craft a malicious Parcel object targeting readLazyValue
3. Trigger the confused deputy condition to load arbitrary code
4. Execute the loaded code to escalate privileges within System Settings

How to detect it

Review Android system logs and Parcel-related error entries for signs of unexpected code loading or privilege changes; check for anomalies in System Settings app behavior post-exploitation.

What your security team should do

• Prioritize patching Android devices to current versions
• Monitor for any local privilege escalation attempts in system logs
• Apply the specified OPA commit if using the listed package